feat(rate-limiting): Implement core rate limiting functionality with configuration, decision-making, metrics, middleware, and service registration

- Add RateLimitConfig for configuration management with YAML binding support.
- Introduce RateLimitDecision to encapsulate the result of rate limit checks.
- Implement RateLimitMetrics for OpenTelemetry metrics tracking.
- Create RateLimitMiddleware for enforcing rate limits on incoming requests.
- Develop RateLimitService to orchestrate instance and environment rate limit checks.
- Add RateLimitServiceCollectionExtensions for dependency injection registration.

docs/modules/issuer-directory/architecture.md

@@ -10,16 +10,16 @@ Issuer Directory centralises trusted VEX/CSAF publisher metadata so downstream s
 
 - **Service name:** `stellaops/issuer-directory`
 - **Framework:** ASP.NET Core minimal APIs (`net10.0`)
-- **Persistence:** MongoDB (`issuer-directory.issuers`, `issuer-directory.issuer_keys`, `issuer-directory.issuer_audit`)
+- **Persistence:** PostgreSQL (`issuer_directory.issuers`, `issuer_directory.issuer_keys`, `issuer_directory.issuer_audit`)
 - **AuthZ:** StellaOps resource server scopes (`issuer-directory:read`, `issuer-directory:write`, `issuer-directory:admin`)
 - **Audit:** Every create/update/delete emits an audit record with actor, reason, and context.
 - **Bootstrap:** On startup, the service imports `data/csaf-publishers.json` into the global tenant (`@global`) and records a `seeded` audit the first time each publisher is added.
 - **Key lifecycle:** API validates Ed25519 public keys, X.509 certificates, and DSSE public keys, enforces future expiries, deduplicates fingerprints, and records audit entries for create/rotate/revoke actions.
 
 ```
-Clients ──> Authority (DPoP/JWT) ──> IssuerDirectory WebService ──> MongoDB
+Clients ──> Authority (DPoP/JWT) ──> IssuerDirectory WebService ──> PostgreSQL
                                             │
-                                            └─> Audit sink (Mongo)
+                                            └─> Audit sink (PostgreSQL)
 ```
 
 ## 3. Configuration
@@ -42,12 +42,12 @@ IssuerDirectory:
   tenantHeader: X-StellaOps-Tenant
   seedCsafPublishers: true
   csafSeedPath: data/csaf-publishers.json
-  Mongo:
-    connectionString: mongodb://localhost:27017
-    database: issuer-directory
-    issuersCollection: issuers
-    issuerKeysCollection: issuer_keys
-    auditCollection: issuer_audit
+  Postgres:
+    connectionString: Host=localhost;Port=5432;Database=issuer_directory;Username=stellaops;Password=secret
+    schema: issuer_directory
+    issuersTable: issuers
+    issuerKeysTable: issuer_keys
+    auditTable: issuer_audit
 ```
 
 ## 4. API Surface (v0)
@@ -74,7 +74,7 @@ Payloads follow the contract in `Contracts/IssuerDtos.cs` and align with domain
 ## 5. Dependencies & Reuse
 
 - `StellaOps.IssuerDirectory.Core` — domain model (`IssuerRecord`, `IssuerKeyRecord`) + application services.
-- `StellaOps.IssuerDirectory.Infrastructure` — MongoDB persistence, audit sink, seed loader.
+- `StellaOps.IssuerDirectory.Infrastructure` — PostgreSQL persistence, audit sink, seed loader.
 - `StellaOps.IssuerDirectory.WebService` — minimal API host, authentication wiring.
 - Shared libraries: `StellaOps.Configuration`, `StellaOps.Auth.ServerIntegration`.