docs: complete BE-011 rate-limiter-tier-policies hardening

[Hollujay]

Closes #684

Summary

Completes the Rate Limiter Tier Policies (BE-011) capability for the Revora backend: the core middleware, unit tests, property-based tests, and application wiring were completed in prior work; this PR finalises the security documentation, marks the implementation-plan tracker complete, and includes supporting artifacts.

What's in this PR

1. Hardened security documentation — docs/rate-limiter-tier-policies.md

• New "Untrusted Tier Header" security assumption: x-revora-rate-tier is treated as untrusted client input; elevation to trusted/internal always requires a matching shared secret (Requirement 10.1).
• New "Pluggable Store (RateLimitStore)" section: documents the RateLimitStore interface contract (increment/reset/clear?), the semantics the fixed-window middleware relies on (deterministic resetAt), and implementor guidance for distributed deployments (Redis INCR/EXPIRE, failure-mode guidance) — Requirements 11.2–11.6.
• Security assumptions renumbered 1–7; abuse scenarios and failure paths expanded (Requirements 10.6–10.7).

2. Implementation plan tracker — .kiro/specs/rate-limiter-tier-policies/tasks.md

Marks tasks 7–10 complete, all verified:

• Task 7 — property-based test suite (fast-check) passes: rateLimitStore, resolveTier, rateLimitMiddleware.
• Task 8 — security documentation hardened (this PR).
• Task 9 — middleware wiring verified: createStartupAuthTierLimiter mounted on POST /api/v1/startup/register, app.set('trust proxy', 1) present, /health registered outside the rate-limited router with an integration test proving isolation.
• Task 10 — coverage gate passed (see Verification).

Verification

Check	Result
npm run test:coverage:backend-011	✅ 132/132 tests pass (rateLimit, startupAuthRateTierPolicy, health integration)
rateLimit.ts coverage	✅ 100% stmts / 100% branch / 100% funcs / 100% lines (≥95% required)
startupAuthRateTierPolicy.ts coverage	✅ 100% stmts / 100% branch / 100% funcs / 100% lines (≥95% required)
Property tests (fast-check)	✅ deterministic, no flakiness observed

Security notes

• Tier elevation is gated on a shared secret read from STARTUP_AUTH_TIER_SECRET; missing/invalid secrets fail safe to the standard tier without revealing whether a secret exists (no oracle).
• Rate-limit counters are isolated per tier via key prefixes; spoofed privileged requests consume the standard-tier counter only.
• The in-memory store is process-local; the new docs section prescribes a shared-store contract (e.g. Redis) for multi-instance deployments.
• x-revora-rate-tier is never trusted without a matching secret.

Related

• Specs: .kiro/specs/rate-limiter-tier-policies/ (requirements.md, design.md, tasks.md)
• Docs: docs/rate-limiter-tier-policies.md
• Related: docs/startup-auth-brute-force-mitigation.md, docs/startup-auth-service.md