[Future] Per-TokenRateLimitPolicy mode override (Reservation/CheckReport)

## Summary
Today `mode` (Reservation vs. CheckReport) is cluster-wide only, on the `Kuadrant` CR. This tracks the future work of a genuine policy-level bypass: an entire `TokenRateLimitPolicy` falling back to `CheckReport` (generating `Check`/`Report` wasm actions for every limit it defines) without touching the cluster-wide switch.

Per RFC 0021, `reservation.amount: 0` already covers per-limit opt-out today (it still exercises the reservation machinery, just holding zero quantity) — this issue is specifically about a policy-level toggle, which is a distinct, currently-missing capability.

Design: [RFC 0021, Future possibilities](https://github.com/Kuadrant/architecture/blob/main/rfcs/0021-token-rate-limit-reservations.md#a-mode-override-at-the-tokenratelimitpolicy-level).

Depends on: Kuadrant/kuadrant-operator#2148 (core Reservation/CheckReport reconciler branch landing first).

## Acceptance Criteria
- [ ] `TokenRateLimitPolicy`-level `mode` override field, reusing the existing `PolicyRuleDefaultsMergeStrategy`/`Overrides` machinery from RFC 0009
- [ ] Correctness constraint enforced by design: a single Limitador counter must never be admitted against under both modes simultaneously (relies on the existing per-policy counter exclusivity: each named limit's `conditions` entry is keyed by a hash of `//`, part of a Limitador `Counter`'s identity)
- [ ] Tests confirming two `TokenRateLimitPolicy` resources with identically-shaped limits but different `mode` values never collide on the same counter
- [ ] Docs updated to describe policy-level vs. cluster-wide vs. per-limit (`reservation.amount: 0`) opt-out semantics

## Notes for reviewers
PR description should include: how to review, and manual verification (apply two policies with differing `mode` targeting overlapping scope, confirm counter isolation via Limitador metrics/logs).

Start by reading RFC 0021's policy-level mode override section and the RFC 0009 PolicyRuleDefaultsMergeStrategy/Overrides machinery. Check the existing Reservation/CheckReport reconciler work from issue #2148 before tracing TokenRateLimitPolicy and counter identity behavior. Done means the acceptance criteria pass, including isolation tests for differing modes and documentation covering all three opt-out levels.

Written by the indexing model from the issue text.