feat: per-host request gate with adaptive cooldown for concurrent fetches

[AnderEnder]

Problem

Concurrent fetches to the same host trip provider per-domain rate limits (HTTP 429). The worst case is the MCP server: fetch_feed takes a single URL and built a fresh HttpClient per call, sharing only the cache — so several concurrent tool calls burst one host with no coordination. A single in-flight retry (ADR-0015) can't help across concurrent requests. An empirical probe also showed some providers send no Retry-After and throttle even serial requests, so serialization alone isn't enough.

Change

A process-wide per-host request gate (src/ratelimit.rs) owned by a reused HttpClient that RssServer builds once and shares across tool calls (also restoring keep-alive). Keyed on authority (host:port):

• Concurrency cap (default 1) — serializes same-host requests; distinct hosts stay fully parallel.
• Adaptive cooldown — honors Retry-After (delta-seconds and HTTP-date) when sent; otherwise a bounded escalating backoff (2s·2^(n-1), capped 60s) that resets on success.
• Sticky spacing — ~1s between requests once a host is warm; zero cost on hosts that never throttle.
• Server absorbs waits up to a bound, then fails fast with a structured RATE_LIMITED error carrying retry_after so an agent can pace.

Paired: descriptive User-Agent; HTTP-date Retry-After parsing. All tunables are env-overridable (RSS_HOST_CONCURRENCY, RSS_MAX_COOLDOWN_SECS, RSS_MAX_GATE_WAIT_SECS).

Contract / invariants

• SCHEMA_VERSION stays "1" — RATE_LIMITED is an additive error code; details are free-form.
• CLI + MCP share core (wiring is additive: fetch_feeds_with(&HttpClient)); no pacing logic in mcp.rs.
• The ADR-0015 in-flight retry is unchanged and its cap (RETRY_MAX_DELAY 5s) is kept distinct from the sibling-facing cooldown cap.

See ADR-0016 for rationale and alternatives.

Testing

cargo fmt --check, cargo clippy --all-targets -D warnings, and cargo test all pass (87 lib + integration). New tests cover gate serialization, per-host isolation, cooldown escalation/cap, sticky spacing, fail-fast ceiling, cancellation, Retry-After parsing (both forms), and the RATE_LIMITED contract. Reviewed via a multi-dimension adversarial pass; a live fetch confirms the happy path adds no latency.

Follow-ups (deliberately out of scope)

• Multi-URL fetch_feed (urls: [..]) so the server paces a batch internally — larger contract surface; possible future ADR.
• Cross-host redirect attribution: the gate keys on the request host; a cross-host redirect's throttle is attributed to the origin (documented, low impact).