fix: replace broken DashMap rate limiting with tower-governor middleware

- Replace custom DashMap<IpAddr, Instant> rate limiting in enrollment.rs
  that fell back to 0.0.0.0 when X-Forwarded-For was missing, causing
  ALL enrollment traffic to share a single global rate limit bucket
- Use tower_governor with SmartIpKeyExtractor for proper per-IP rate
  limiting that respects X-Forwarded-For headers (critical behind HAProxy)
- Add three configurable rate limit tiers via config.toml:
  * Enrollment: 5 req/min per IP, burst 3 (strict)
  * Auth: 20 req/min per IP, burst 10 (moderate)
  * API: 120 req/min per IP, burst 30 (normal)
- Remove enrollment_rate_limits from AppState and cleanup task
- Remove manual rate limit code from enrollment.rs (headers param, IP extraction)
- Add into_make_service_with_connect_info for ConnectInfo fallback
- Add RateLimitConfig to AppConfig with sensible defaults

Fixes: #1

Cargo.toml

@@ -81,5 +81,9 @@ aes-gcm = { version = "0.10" }
 ipnet = { version = "2" }
 url = { version = "2" }
 
+# Rate limiting
+tower_governor = { version = "0.8", features = ["tracing"] }
+governor = "0.6"
+
 # Email
 lettre = { version = "0.11.22", features = ["tokio1-rustls-transport"] }