Rate limiting: named policies from configuration instead of five fixed limits

Rate limits are a fixed set of members, `Global`, `Auth`, `Batch`, `Registration` and `Renderer`, each with its own default and config section: `barakoCMS/Infrastructure/Security/RateLimitSetup.cs:50-60` and `:82-87`. A new limit means new code in core.

### Why it is too specific

#813 already needs a limit per public form. A booking lookup, an OTP send, a school's enrolment form and a clinic's appointment request will each want their own, and each would add another fixed member. How a limit partitions (by IP, by user, by key) is also fixed per member rather than chosen.

### The general concept

Named policies under `RateLimiting:Policies:{name}`, each with a window and a partition (IP, user or key). Endpoints and modules refer to a policy by name, and the five current limits become built-in policies with today's defaults. The per-form limit in #813 then becomes a policy a form definition names.

### Where it lives

Core: `Infrastructure/Security/RateLimitSetup.cs`.

### Compatibility

Released config keys. `RateLimiting:Global`, `Auth`, `Batch`, `Registration` and `Renderer` keep working as aliases for the built-in policies, and the policy name constants stay. Defaults do not change. No HTTP change.

### Done when

- A policy defined only in configuration can be applied to an endpoint and limits it, and a test showing that fails before the change.
- Existing settings such as `RateLimiting:Global:PermitLimit` still apply.
- The five built-in limits behave as they do today.

Found in the too specific sweep of 15 September 2026.

Start with Infrastructure/Security/RateLimitSetup.cs, especially the existing members and configuration sections at lines 50-60 and 82-87. Trace how endpoints and modules currently select limits before designing named configuration policies. Done means configuration-only policies can limit an endpoint, existing keys and defaults remain compatible, and the five built-in limits behave unchanged.

Written by the indexing model from the issue text.