Function createRateLimitHooks

Create metadata-driven rate-limit hooks.

The hook reads contract.metadata.rateLimit. Global and IP-scoped limits run in onRequest before context creation; user-scoped limits run in beforeHandle after route hooks have resolved identity and ctx.actor is available. Exceeded limits throw the framework TooManyRequests app error with scope, retryAfterSeconds, and resetAt details, and the 429 response carries a Retry-After header when the limiter reports a reset time. The bucket key is never sent to clients; denials emit a rateLimit.denied instrumentation event that carries the key for operators.

ip-scoped limits require an explicit trustedProxy.clientIp, ipSource, or custom earlyKey: the hook's validate phase fails createServer(...) startup when a registered contract declares an ip scope without one, instead of silently collapsing all clients into a shared ip:unknown bucket. Contracts added later through server.route(...) are not visible to validate, so enforcing an ip-scoped limit without a client-IP source throws the same configuration error at request time as a backstop. Pass ipSource: "none" to explicitly opt in to the shared ip:unknown bucket.