feat(mcp): cap read volume per caller identity

A scope authorises a read and says nothing about volume. An agent reads a
thousand records in seconds where a person clicks ten, and until now nothing
noticed: the token is valid, the tool is permitted, the ACL passes. That gap
stopped being theoretical the day an autonomous run started reading the whole
catalog on a schedule.

identifier: credential keys the counter on the sub claim — the end user,
whoever is asking on their behalf — so an agent looping under one person's
identity spends that person's budget and cannot spend everyone's. Verified on
catalog: pm-user and ro-user hold separate counters.

Per-route namespace, so a busy domain cannot exhaust another's.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

dev/flux-kustomization.yaml

@@ -24,6 +24,8 @@ spec:
       BACKEND_HOST: classic-models-api.classic-models.svc.cluster.local
       OIDC_ISSUER: https://keycloak.sttlab.local/realms/classic-models
       API_AUDIENCE: '["workforce-api"]'
+      # Read volume for an MCP caller, per identity per minute.
+      MCP_READS_PER_MINUTE: "60"
       BACKEND_AUDIENCE: '["classic-models-api"]'
       BACKEND_SCOPES: '[]'
       API_RATE_LIMIT_MINUTE: "60"