Stage 46 — API Rate Limiting

Adds server-side rate limiting to authenticated API requests through upgrade/core/api_auth.php.
Default: 120 requests per user/IP per 60 seconds. Exceeded requests receive HTTP 429 and Retry-After: 60.
Rate-limit state is stored in the PHP system temporary directory; no database/schema changes are made.

Test: /upgrade/stage46.php
Do not import SQL.
