Server: move the auth rate limiter to a shared sliding-window store (closes #182)

[testtest126]

Summary

Closes #182 (the chosen Postgres-backed fix). Refs #79 (parent, "premature until the server runs more than one instance" — re-parked 2026-07-12, now being revived).

This is a revival, not a new build. History for the next reviewer, so nobody starts from a stale claim:

• This branch (issue-79-pg-rate-limiter) was previously opened as PR Server: move the auth rate limiter to a shared sliding-window store (closes #79) #136, got a Security review: APPROVE @ 1b466b4, was un-drafted, then closed unmerged per the owner's "Rate limiter: shared store once the server scales past one instance #79 stays parked" decision — the closing note pointed future revivals at "a security APPROVE at that exact head."
• An independent second review then posted Security review: BLOCK @ 1b466b4, explicitly voiding that APPROVE as unsound (it claimed a fail-closed-on-DB-error test existed when none did, and the PR was un-drafted 4 seconds after the APPROVE with zero line comments). Code itself was assessed "close to approvable" — three concrete gaps:
  1. PR body described schema/sweep/429-vs-500 details the diff didn't actually contain.
  2. Missing tests: DB-error fail-closed, and a genuinely concurrent burst (not sequential awaits) that would catch a non-atomic store.
  3. CI only ever exercised SQLite; the production ON CONFLICT upsert path against real Postgres never ran.

This PR rebases the original implementation onto current main and closes all three gaps for real:

1. Fail-closed, end to end. testLimiterFailsClosedWhenStoreIsUnavailable breaks the store and asserts check throws; testMiddlewareFailsClosedWhenStoreIsUnavailable asserts the HTTP layer turns that into a non-2xx response with no account created.
2. Genuine concurrency. testConcurrentRequestsShareOneAtomicBudget fires 40 real concurrent requests at one shared connection via withThrowingTaskGroup and asserts the atomic upsert holds the budget to exactly the configured limit — the race a non-atomic "SELECT then write" store would fail.
3. Real Postgres in CI. New non-required job server-postgres in .github/workflows/ci.yml installs local Postgres 16 and runs the rate-limiter test group against it (not the whole suite — unrelated tests assert global table counts that only hold under SQLite's per-test fresh in-memory database, not a shared persistent Postgres). Validated locally: the exact INSERT … ON CONFLICT … DO UPDATE … RETURNING runs correctly against real Postgres 16, and the 12 rate-limiter/HTTP-surface tests pass there.

What it does (accurate this time)

• Schema: new table auth_rate_windows (key text, bucket bigint, count int, unique on key+bucket), added via CreateAuthRateWindow migration.
• Sliding window: each request lands in a window-second bucket; the verdict weighs the current bucket plus the previous bucket decayed linearly by how far the current bucket has progressed — closes the 2× boundary burst a fixed window admits.
• Atomicity: one INSERT … ON CONFLICT … DO UPDATE … RETURNING counts and reads in a single statement, so concurrent requests across instances can never both take the last free slot.
• Sweep: buckets outside current±1 are deleted at most once per window (after the verdict, errors logged not thrown) so the table stays bounded.
• 429 vs 500: a limited request gets 429 + Retry-After; a DB failure propagates as an uncaught error, which Vapor's default error middleware maps to a generic 500 — the request never reaches the route handler either way (fail-closed).
• Same config surface: AUTH_RATE_LIMIT, AUTH_RATE_LIMIT_WINDOW, same middleware/keying (Fly-Client-IP → last XFF → peer address), same 429 surface as the old in-memory limiter.

Not touched: PR #116 / branch claude/smiley-face-1xzfkz (a separate, independent implementation of the same feature) and its stack of open descendants (#161, #164, #177) — explicitly out of scope for this PR.

Test plan

• swift test --package-path chess-server: 96/96 pass at head 511a5e2 (Xcode-beta toolchain, local run).
• swift test --package-path ChessKit: untouched by this PR (no ChessKit files changed).
• Rate-limiter test group (12 tests) run against a real local Postgres 16: pass.
• New CI job server-postgres added to validate this on every push going forward (informational, not required).

Security-sensitive: draft, awaiting review

This touches abuse protection on the auth surface (CLAUDE.md rule 5). Stays draft until a root/orchestrator session posts a fresh verdict — the prior APPROVE at 1b466b4 is void (superseded by the BLOCK, and doubly void by this rebase to a new head). This PR does not self-merge, arm auto-merge, or carry any security verdict.

Approval command (run by the human, at the exact pushed head):

Security review: APPROVE @ 511a5e261da451dd37352b6a46a90e3fe64ca8fd