fix(security): harden rate limiter proxy handling

[changliuchang777]

Summary

• add TRUST_PROXY parsing and configure Express trust proxy explicitly, defaulting to false
• keep spoofed X-Forwarded-For ignored unless trusted proxy hops are configured
• add lazy expired-bucket GC so stale rate-limit entries are removed even when clients never return
• keep the existing Retry-After and 429 rate_limited response behavior unchanged
• document TRUST_PROXY and add focused rate-limit tests for proxy parsing and lazy GC

Fixes #8

Validation

• git diff --check passed except Git for Windows LF/CRLF warnings
• npm test -- --runInBand src/__tests__/rateLimit.test.ts blocked by existing baseline parse error in src/index.ts: duplicate WEBHOOK_MAX_EVENTS
• npm run build blocked by existing baseline TypeScript errors in src/index.ts and src/__tests__/store.adapter.test.ts
• npm run lint blocked by existing baseline lint errors unrelated to this change