Per-key rate-limit overrides

ApiKey.rateLimitPerMinute opt-in column. Enterprise contracts negotiate per-key caps without a code change; the global default (60 rpm) still applies when null. Surfaces on /api/v1/me + every X-RateLimit-Limit response header for the affected key.