Provide a rate-limit exemption or dedicated budget class for trusted satellite services' user-signed Manager calls

## Problem

BAIFS signs its authorization-bearing Manager calls (`GET /folders`, `myStorageHostPermissions`, create/trash on bucket ops) **as the user**, deliberately, to preserve Manager-side semantics, rate accounting, and audit attribution and to avoid any confused-deputy path. The side effect: those calls consume the **user's own** 15-minute rolling `rate_limit` budget (`api/rest/ratelimit/handler.py`) — the same budget their WebUI/CLI usage draws from.

The 30 s authz cache bounds this to ≈4 calls/user/minute in the common case (folder list + host-permission map per TTL window), but a pathological many-bucket automation workload could still pressure a user's budget through the gateway.

## Request

One of:

1. A **rate-limit exemption** for a designated trusted satellite-service principal's user-signed traffic, or
2. A **dedicated budget class** so satellite-originated user-signed calls draw from a separate pool that does not starve the user's interactive budget.

Whichever is chosen should keep audit attribution to the real user intact (the reason BAIFS signs as the user in the first place).

## Rationale

- S3 traffic is far chattier than the REST API the per-keypair limit was sized for.
- Preserves the "sign as the user" security property while removing the shared-budget coupling.
- Bounded and low-risk: applies only to an explicitly trusted service principal.

## Citations (`6d680960d`)

- Per-keypair rolling limiter: `manager/api/rest/ratelimit/handler.py`.
- Authz-cache bound on call rate: [docs/02 §4.4](../../02-authentication.md); coupling discussion: [docs/07 Q8](../../07-risks-open-questions.md).

---
_Filed from the BAIFS project: see lablup/BAIFS#6 and `docs/spikes/upstream-asks/04-rate-limit-budget-class.md` for full context and citations._

Start with manager/api/rest/ratelimit/handler.py, then read docs/02 §4.4, docs/07 Q8, and docs/spikes/upstream-asks/04-rate-limit-budget-class.md for the BAIFS context. Clarify which of the two requested designs is intended and trace how user-signed calls are identified. Done means trusted satellite traffic has separate or exempt accounting while audit attribution remains with the real user.

Written by the indexing model from the issue text.