feat(core-shared): add withRateLimit wrapper and conformance enforcement

- Add withRateLimit(rateLimit, fn) in rate-limit/with-rate-limit.ts,
  attaching the RateLimited brand at DI bind time
- Extend wireUseCase to accept optional rateLimit?: IRateLimit and
  compose withRateLimit innermost (before analytics/audit); propagate
  __rateLimited through analytics + audit inline wrappers
- Extend withSpan and withCapture PROPAGATED_BRANDS to include
  __rateLimited so the outermost binding carries the brand
- Extend assertFeatureConformance to require __rateLimited brand when
  manifest.useCases[name].rateLimit.length > 0; refactored into
  helper functions to stay within complexity thresholds
- Add rateLimit?: IRateLimit to BindContext; default to NoopRateLimit
  in web-next bindAllProduction and bindAllDevSeed aggregators
- Unit tests for withRateLimit brand attachment, factory passthrough,
  and composition; synthetic fixture tests for conformance errors

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/web-next/src/server/bind-production.ts

@@ -16,6 +16,7 @@ import {
   PayloadJobQueue,
   type IJobQueue,
 } from "@repo/core-shared/jobs";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { bindProductionBlog } from "@repo/blog/di/bind-production";
 import { bindProductionAuth } from "@repo/auth/di/bind-production";
 import { bindProductionMarketingPages } from "@repo/marketing-pages/di/bind-production";
@@ -97,6 +98,7 @@ export async function bindAllProduction(): Promise<void> {
     tracer,
     logger,
     queue,
+    rateLimit: new NoopRateLimit(),
   };
 
   bindProductionAuth(ctx);
@@ -121,6 +123,7 @@ export async function bindAllDevSeed(): Promise<void> {
     tracer,
     logger,
     queue,
+    rateLimit: new NoopRateLimit(),
   };
 
   await bindDevSeedAuth(ctx);