docs: document Hosted rate-limit env vars and Retry-After behavior

[CodewithJha]

Problem

P1-2 shipped in-process rate limits (apps/api/src/mutiny_api/rate_limit.py) with env knobs (MUTINY_RATE_LIMIT_*, Retry-After, 429 rate_limit_exceeded). Operator-facing docs are thin relative to code — SECURITY.md mentions order of middleware, but contributors lack a single field guide like the health-doc issue (#8).

Repository evidence

• rate_limit.py — defaults, env parsing, Retry-After helper
• tests/unit/test_rate_limit.py, tests/integration/test_api_hosted_rate_limit.py
• SECURITY.md auth/rate-limit section

Why it matters

Operators tuning single-tenant Hosted need to know defaults and that limits are not distributed.

Proposed direction

Add docs/RATE_LIMITS.md (or SECURITY subsection) listing env vars, defaults, identity keying (Bearer vs anonymous), and client expectations for Retry-After. Link from docs/README.md.

Acceptance criteria

• Env vars + defaults documented from code (not invented)
• Explicit “in-process / per-process only” warning
• Linked from docs hub and/or SECURITY.md
• No behavior change required

Testing expectations

Docs-only; optional assert that documented env names exist as constants in rate_limit.py.

Difficulty

S · docs · good first issue