feat(mcp): cap read volume per caller identity

A scope authorises a read and says nothing about volume. An agent reads a
thousand records in seconds where a person clicks ten, and until now nothing
noticed: the token is valid, the tool is permitted, the ACL passes.

identifier: credential keys the counter on the sub claim — the end user, whoever
is asking on their behalf — so an agent looping under one person's identity
spends that person's budget and cannot spend everyone's. Per-route namespace, so
a busy catalog cannot exhaust another domain's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/flux-kustomization.yaml

@@ -28,6 +28,11 @@ spec:
       BACKEND_AUDIENCE: '["classic-models-api"]'
       BACKEND_SCOPES: '[]'
       API_RATE_LIMIT_MINUTE: "60"
+      # Read volume for an MCP caller, per identity per minute. An agent
+      # reads a thousand records in seconds where a person clicks ten; this is
+      # the only control that notices. Generous enough that a conversational
+      # turn never meets it, tight enough that a loop does.
+      MCP_READS_PER_MINUTE: "60"
       # The URI path is the collector's routing key: Fluent Bit tags the
       # record `catalog` and turns that into the Loki label domain=catalog.
       AUDIT_LOG_ENDPOINT: http://audit-log-collector.observability.svc.cluster.local/catalog