#952 Move API workflow-submission bucket (require_rate_limit / TenantRateLimiter.check_quota) to TokenGate, decoupled from run leases

EARS: The workflow submission rate limit shall be a TokenGate rate_limit policy on resource hw.workflow.submissions per tenant subject; while run-concurrency leases (consume_with_lease) shall stay local. Today both share tenant_rate_limits.tokens, so the move changes lease semantics and needs a design decision. Found during #928 inventory. api/blueprints/v1/workflows.py was being edited by another agent at the time.