[Deferred] In-memory rate limiting for CLI / single-replica deployments

[jerm-dro]

User Story

As a developer running ToolHive locally,
I want rate limiting without Redis,
so that I can enforce limits in single-process mode.

Context

Deferred — not part of the initial implementation. Created for visibility.

Could follow the same dual-mode pattern as session storage (memory vs Redis). See THV-0057.

Acceptance Criteria

• In-memory token bucket backend
• Same config surface as Redis-backed
• Dual-mode pattern matching session storage

Dependencies

• STORY-001, STORY-002 (core rate limit infrastructure)