test(QA): refactor Locust tests, add rate-limit and S3 load tests

[codewithme-py]

• Refactored Locust tests to use DRY helpers in BaseUser
• Added locustfile_ratelimit to verify Redis Lua rate-limiting correctly returns 429 Too Many Requests for POST /api/v1/inventory/reserve.
• Added locustfile_s3.py to stress-test POST /api/v1/media/products/{id}/upload_url generation.
• Updated Makefile with targets ratelimit-test and s3-test.