Harden attestation abuse controls and operations

[aliXsed]

Summary

• add per-IP load shedding and atomic Redis-backed per-wallet challenge/attempt limits before expensive verification
• archive verified iOS CBOR and decoded Android verdicts to GCS on a best-effort, non-gating path
• add structured privacy-safe events, Play Integrity timeouts/sanitized errors, monitoring guidance, and quota runbook
• expose /health for Cloud Run while retaining /healthz compatibility, and expand Rust/Redis/Node coverage

Test plan

• cargo test --workspace
• cargo clippy --all-targets --all-features -- -D warnings
• cargo fmt --all -- --check
• coverage: 82.07% lines / 83.75% regions (thresholds 80% / 78%)
• ./scripts/run-polyglot-nodejs-e2e.sh
• deployed digest sha256:c7abdd9c...b05104 to staging through infra PR NodleCode/infra#1253
• staging Node integration: 13/13 passed; /health returns 200; Cloud Run ready; no revision errors; structured event verified

Infrastructure: https://github.com/NodleCode/infra/pull/1253

[github-actions]

Coverage report

Thresholds: 80% line · 78% region (condition)

✅ Coverage meets the required threshold.

   13|      1|            .init(),
   14|      3|        _ => registry.with(tracing_subscriber::fmt::layer()).init(),
   15|       |    }
   16|      4|}