feat(mcp): cap read volume per caller identity

A scope authorises a read and says nothing about volume. An agent reads a
thousand records in seconds where a person clicks ten, and until now nothing
noticed: the token is valid, the tool is permitted, the ACL passes.

identifier: credential keys the counter on the sub claim — the end user, whoever
is asking on their behalf — so an agent looping under one person's identity
spends that person's budget and cannot spend everyone's. Per-route namespace, so
a busy catalog cannot exhaust another domain's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kong/kustomization.yaml

@@ -17,6 +17,7 @@ resources:
   - mcp/consumergroups.yaml
   - mcp/ai-mcp-proxy.yaml
   - mcp/openid-connect.yaml
+  - mcp/rate-limiting.yaml
   - mcp/audit-log.yaml
   - mcp/audit-log-body-capture.yaml
   - mcp/audit-log-body-capture-bindings.yaml