feat(sites): cross-process site rate limit via PG token bucket

Migration 0041_rate_limit adds rate_limit_bucket. PgTokenBucket (@umt/db)
refills and takes tokens under SELECT ... FOR UPDATE on the DB clock and
polls with jitter within a wait budget; penalize() carries Retry-After.
Site adapters get createSharedSiteRateLimiter (key site:<id>), shared by
api / worker / worker:agent, with an in-process serial queue in front and
a local fallback when the bucket is unavailable.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/db/test/schema.test.ts

@@ -115,6 +115,8 @@ const EXPECTED_TABLES = [
   "admin_recovery_code",
   "admin_passkey",
   "webauthn_challenge",
+  // C2-A 跨进程站点限流(0041)
+  "rate_limit_bucket",
 ].sort();
 
 /** 不走 entityTable() 的表:追加型/引擎自有表,没有 uuid id + created_at/updated_at 三件套 */
@@ -139,6 +141,8 @@ const NON_ENTITY_TABLES = [
   // 一次性凭据:只记创建 / 用掉的时间
   "admin_recovery_code",
   "webauthn_challenge",
+  // 限流桶:key 主键,只有 updated_at
+  "rate_limit_bucket",
 ];
 
 describe.skipIf(skip)("schema migrations (real PG)", () => {