[emmanuelgautier]

Closes #12.

Adds the ratelimit category (three aggressive-suite checks, run only with --aggressive) with a shared bounded-burst helper (rlprobe). Bursts are deliberately small (~20–30 requests) — they measure throttling behaviour, not a flood.

• ratelimit.missing_throttling — bursts from one client and reports when none is throttled (informational-to-low: backend/external throttling isn't visible to a single-client burst).
• ratelimit.spoofed_ip_bypass — for a throttling proxy, confirms a plain request is still throttled, then flips the response back to success by rotating a spoofed IP in X-Forwarded-For/X-Real-IP/True-Client-IP/X-Client-IP/X-Forwarded; skips when no throttling is seen.
• ratelimit.oversized_header — sends one 128 KiB header and flags acceptance instead of a 431/400/413 rejection.

Checklist coverage

• Per-IP / per-token throttling enforced at the proxy
• Rate-limit bypass via spoofed client-IP headers
• Oversized header / oversized request handling
• Slowloris / slow-body resistance — intentionally deferred (genuine DoS that can degrade a live target even when bounded)
• Connection and keepalive limits under load — intentionally deferred (same reason)

Deferred items are documented in docs/checks/ratelimit.mdx. Includes registration and a category test (no-limit / per-client-key / global-key / reject-big stand-ins).