feat(mcp): cap read volume per caller identity

A scope authorises a read and says nothing about volume. An agent reads a
thousand records in seconds where a person clicks ten, and until now nothing
noticed: the token is valid, the tool is permitted, the ACL passes. That gap
stopped being theoretical the day an autonomous run started reading the whole
catalog on a schedule.

identifier: credential keys the counter on the sub claim — the end user,
whoever is asking on their behalf — so an agent looping under one person's
identity spends that person's budget and cannot spend everyone's. Verified on
catalog: pm-user and ro-user hold separate counters.

Per-route namespace, so a busy domain cannot exhaust another's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

kong/mcp/rate-limiting.yaml

@@ -0,0 +1,37 @@
+# A read-volume cap per caller identity.
+#
+# A scope authorises a read and says nothing about volume. An agent reads a
+# thousand records in seconds where a person clicks ten, and the difference is
+# invisible to every control the estate had until now — the token is valid, the
+# tool is permitted, the ACL passes.
+#
+# `identifier: credential` keys the counter on what the openid-connect plugin
+# published as the caller's credential, which is the `sub` claim: the end user,
+# whoever is asking on their behalf. So an agent looping under one person's
+# identity spends that person's budget, and cannot spend everyone's.
+apiVersion: configuration.konghq.com/v1
+kind: KongPlugin
+metadata:
+  name: ${NAME}-customers-mcp-rate-limiting
+  namespace: ${NAMESPACE}
+plugin: rate-limiting-advanced
+config:
+  identifier: credential
+  # Per-route counters. Sharing a namespace across domains would let a busy
+  # domain exhaust the budget for another.
+  namespace: ${NAME}-customers-mcp
+  strategy: local
+  sync_rate: -1
+  window_type: sliding
+  window_size:
+    - 60
+  limit:
+    - ${MCP_READS_PER_MINUTE}
+  # Loud rather than silent: a caller that hits the cap is told, and the headers
+  # say when it resets. An agent that only sees a 429 with no Retry-After
+  # retries immediately and makes it worse.
+  hide_client_headers: false
+  error_code: 429
+  error_message: >-
+    Read volume limit reached for this identity. This is a cap on how much can
+    be read per minute, not a permission problem.