#928 Quotas/rate limits via TokenGate (tenant 'highway', subjects per Highway tenant); leases stay local

EARS SPEC: - The rate_limits API shall keep its request/response contract while storing policies in TokenGate. - Metered tool calls shall consume from TokenGate keyed on (run_id, task_id, attempt) and refund on transaction rollback. - If TokenGate is unreachable, then metered calls shall fail closed and /api/v1/health shall report degraded. - Both directions shall be tested: blocks when exceeded and resumes when quota is available. Parent epic: #913. Synthesis (technical problems / solution domains / alternatives) recorded as a comment when started.