feat(sync): bound egress with a global byte rate limiter (#1157)

[skakri]

A public read-only node (#1157) serves anonymous readers, so its outbound bandwidth must be bounded or a peer can drain it by repeatedly pulling the snapshot. This adds a global egress cap — the last abuse-hardening gate before such a node is exposed.

What changed

• GlobalEgressLimiter — a token bucket over bytes served, GLOBAL rather than per-peer (a per-id budget is evaded by rotating node ids — the same Sybil reasoning as the merged accept-rate limiter), shared across the host's concurrent session tasks via Arc<Mutex>. Burst 64 MiB, refill 16 MiB/s (implementation-local, tunable later).
• Trim, don't truncate mid-stream. The session sender trims the set it offers to the prefix the budget affords, then pages it with the unchanged paging loop — so every page's more flag stays correct and a throttled transfer is a valid session (not a protocol error). The withheld tail is re-offered by the next session's inventory diff, so a throttled reader converges across retries. The budget is charged per entry under one lock, released before any .await and poison-tolerant.
• Metered where it matters. Both dispatchers meter the anonymous-servable account-log and /3 content paths; table sync is admitted only under Closed, so it carries no anonymous egress and is left unmetered.
• The resident host and sync serve each own one limiter shared across their connections.

With this, a published node authors public (#1158), serves anonymous read (#1161), and is egress-bounded — the abuse posture (global accept-rate + per-peer session caps + per-account byte ceilings + this egress cap; anonymous readers cannot push) needed to expose it.

Tests

The bucket bounds bytes then refills; an exhausted budget serves nothing and converges after refill; a multi-page transfer (>MAX_ENTRIES_PER_PAGE) under a generous budget is served intact with a correct sent count.

Verification

cargo +nightly fmt --check; clippy --workspace --all-targets under --no-default-features and --all-features, plus the --features eval gates — all -D warnings clean; cargo nextest run --workspace (5010) and cargo test -p rag-rat-sync (both CI runners).