Extends the per-provider limit with a per-second cap (client_rate_limit_rps)
alongside the existing per-minute/per-hour. A per-second bound is the most
effective defense against sub-second retry storms (the shape of the estate
app's hammering). Enforcement now checks 1s / 60s / 3600s windows; dashboard
provider forms gain a "per second" input. 0 = unlimited on every tier.

kilo-spora configured to rps=2, rph=200 to cap its load on kilo's per-IP free
quota (the cascade that was 429-ing kilo-stefy / breaking the lisa rotation).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>