helix-shared-edge-ratelimit: unified rate limiting APIs

## Background

PR [#77](https://github.com/adobe/helix-deploy-plugin-edge/pull/77) identifies platform differences in rate limiting APIs. Per [comment](https://github.com/adobe/helix-deploy-plugin-edge/pull/77#issuecomment-3554569809), we need a unified wrapper/plugin in helix-shared.

## Platform Differences

**Fastly:**
- `EdgeRateLimiter` with `RateCounter` and `PenaltyBox`
- Synchronous, direct runtime calls
- Built-in penalty box enforcement
- Windows: 1s, 10s, 60s

**Cloudflare:**
- Binding-based rate limiting via `wrangler.toml`
- Async Promise API
- Eventually consistent per-location
- Windows: 10s, 60s only

## Requirements

1. Unified async interface supporting both platforms
2. Support common time windows (10s, 60s)
3. Penalty box abstraction (native on Fastly, KV/DO on Cloudflare)
4. Platform detection and appropriate delegation

## Implementation

Target: `packages/helix-shared-edge-ratelimit/`

Interface:
```javascript
interface UnifiedRateLimiter {
checkRate(key: string, options?: RateLimitOptions): Promise;
}
```

Platform-specific implementations behind unified API.

## Reference

Documentation analysis in [security-ratelimit.md](https://github.com/adobe/helix-deploy-plugin-edge/blob/compat/docs/api-unification/security-ratelimit.md)

Start by reading docs/api-unification/security-ratelimit.md and PR #77, then inspect packages/helix-shared-edge-ratelimit/. Define the platform-specific delegation behind the stated unified async checkRate interface. Done means Fastly and Cloudflare support common 10s and 60s windows, platform detection, and the required penalty-box abstraction.

Written by the indexing model from the issue text.