feat: add rate limiter to APIs

[Bushstar]

This PR introduces configurable rate limiting for all three API services (keymaster, gatekeeper, and search-server) using express-rate-limit, with consistent behavior and environment-driven controls.

• Resolves: Add rate limiter to APIs #1182
• Added API-level rate limiter middleware (/api scope only) to avoid throttling static frontend assets.
• Standardized 429 response payload: {"error":"Too many requests"}.
• Added support for:
  • configurable window (value + unit: second|minute|hour)
  • configurable max requests (default 600)
  • whitelist via CSV IP/CIDR
  • skip paths via CSV
  • optional proxy trust (*_TRUST_PROXY)
  • skipping OPTIONS requests
• Moved Search Server env parsing into a dedicated config module: config.ts, matching the config pattern used by Keymaster/Gatekeeper.
• Updated docs and config wiring:
  • root sample.env
  • service READMEs
  • docker-compose.yml env passthrough for new rate-limit/search-server variables.