Pinning server: enforce resource controls (prereq for production-ready status)

The `filecoin-pin server` daemon does not currently enforce resource controls on `POST /pins`. A single authenticated caller (or any caller when `ALLOW_NO_AUTH=true`) can submit a CID resolving to a very large DAG, or supply a reachable attacker-controlled `origins` peer, and exhaust disk, network, CPU, or libp2p resources on the host. Implementing the controls below is the primary blocker for promoting the pinning server affordance out of beta.

Parent epic: #46.
Advisory: [GHSA-m5ph-mmg5-6w5h](https://github.com/filecoin-project/filecoin-pin/security/advisories/GHSA-m5ph-mmg5-6w5h) (published 2026-06-26).

## What's missing today

- Per-request, per-user, and global rate limits on `POST /pins`
- Per-user / per-token quotas (active pins, total bytes pinned, daily/monthly transfer)
- Maximum DAG byte count, block count, and traversal depth
- Traversal timeout backed by an `AbortController` plumbed into pin operations
- Concurrency cap across in-flight pin operations
- Filesystem quota / bounded storage for `CAR_STORAGE_PATH`
- Partial-CAR cleanup on timeout, cancellation, or limit violations

## Implementation notes

- The codebase already depends on `p-queue`, which is usable for the concurrency gate.
- For route-level rate limiting, `@fastify/rate-limit` is the natural Fastify-side option.
- The pin path goes through `FilecoinPinStore._processPinInBackground` → per-pin Helia node (`createPinningHeliaNode`) → `helia.pins.add(cid)`. Cancellation and limits need to land at each layer (queue admission, traversal cancel, partial-CAR cleanup).

## Acceptance criteria

- [ ] Configured global and per-user concurrency cap
- [ ] Per-token quotas: active pins, total bytes
- [ ] Route rate limit on `POST /pins`
- [ ] DAG hard caps (byte count, block count, traversal depth)
- [ ] `AbortController` plumbed through pin path with configurable timeout
- [ ] Filesystem quota / bounded storage for `CAR_STORAGE_PATH`
- [ ] Partial-CAR cleanup on timeout, cancellation, or limit violations
- [ ] Regression tests for oversized DAGs, excessive concurrent pins, and timed-out pins
- [ ] README "Known limitations and operational guidance" callout removed once all of the above land

## Credit

These hardening requirements were surfaced by an external security report; see the advisory linked above for reporter credit and CVSS scoring.