docs: correct the rate limiting description for the shipped design

[yvesfracari]

Four corrections to the rate limiting description, from implementing COW-1128 in bleu/byos-service-ts (PR #49). Each is a place where the shipped design and the document disagree, and in each case the document is the one that needs to move.

The document said signers below the minimum escrow are "rejected outright". The service cannot do that: it cannot distinguish a never-seen address from an empty one without a chain read on the request path, which the same paragraph forbids. So an unknown address is admitted at the lowest tier and only a known-underfunded one is rejected. Rejecting on absence would lock out every new sub-solver on its first request. The reject-early pipeline also attributed the IP filter to the request path; it belongs at the edge, where a rejected request costs no socket, no ecrecover, and no connection-pool slot — but only while the origin is unreachable directly, otherwise the forwarded client-IP header is attacker-controlled and anything keyed on it is poisoned. That caveat is now stated rather than assumed, since it is the load-bearing precondition for the whole layer.

The floor gate is also scoped to submission, which came out of reviewing the implementation. Effective escrow balance reads as zero from the moment a sub-solver requests a withdrawal, so a gate on every verb left it unable to cancel — or even see — the proposals it still had live, while they stayed live until they expired. Refusing a cancellation is the wrong direction: it is the action that reduces exposure for both sides. The design document's paragraph and pipeline table, the overview's rejection table, and the integration guide's error table all said or implied otherwise.

The overview's synchronous-rejection table gains the escrow floor gate, and the integration guide gains a section on 429, 503 and Retry-After, plus rows in its error table. The guide is explicit that the reference clients ignore Retry-After and that this is a limitation of the examples rather than a pattern to copy.

Once this merges, byos-service-ts bumps its submodule pointer.

[linear-code]

COW-1128