feat(api): Add per-project rate limiting with @nestjs/throttler

Problem

There's no rate limiting on the Tambo Cloud API right now. Any client can fire unlimited requests at any endpoint — threads, runs, OAuth, MCP, everything. This is a problem for a few reasons:

• Someone could brute-force API keys
• A misbehaving client could rack up huge LLM costs
• No protection against basic DoS

What I'd like to add

Integrate @nestjs/throttler (the standard NestJS solution) with a custom guard that:

• Uses the API key (hashed) as the rate limit key so limits are per-project
• Falls back to IP for unauthenticated requests
• Returns proper 429s with Retry-After header and RFC 9457 Problem Details body (matches the existing error format)
• Adds X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset headers to all responses