Rate limits & circuit breakers

Rate limiting is a token bucket per (tenant, principal, capability):

[rate_limit]
capacity = 50        # burst
refill_per_sec = 10  # sustained

An exhausted bucket returns 429.

Circuit breakers are per upstream. After failure_threshold consecutive failures the breaker opens and requests get 503; after cooldown_ms a single half-open probe decides whether to close or re-open. Upstream 5xx and transport errors count as failures.

[circuit_breaker]
failure_threshold = 5
cooldown_ms = 5000

Both are skipped entirely when unconfigured, so the passthrough path keeps its M0 cost.