FEAT: Adaptive Rate Limiting Profiles With Burst Support

[MrEthical07]

Background:
Fixed-window limiting works, but modern production traffic often benefits from burst-aware or adaptive profiles.

Problem:
Current limiter in internal/core/ratelimit/ratelimit.go only supports static fixed-window semantics.

Scope:

• Extend rate limit rule model to support burst and profile behavior.
• Integrate policy-level usage in internal/core/policy/ratelimit.go.
• Preserve backward compatibility with existing rules.

Tasks:

• Add burst/profile fields to rule model.
• Implement limiter decision logic for burst handling.
• Keep Retry-After semantics correct under new model.
• Add tests in internal/core/ratelimit/ratelimit_test.go and internal/core/policy/ratelimit_test.go.

Acceptance Criteria:

• Existing static rule behavior remains unchanged by default.
• New burst/profile mode functions deterministically.
• Retry-After and blocked decisions remain correct and tested.