feat: proactive rate limiting (RPM) + 429 short cooldown for sources

- config.go: Source add RPM field (requests-per-minute cap, 0=unlimited)
- provider.go: RecordRateLimit() — 429 uses fixed 30s cooldown, not exponential
- provider.go: Throttle() — token-bucket proactive rate limiter, spaces requests
  at 60s/RPM interval, respects context cancellation
- provider.go: ReportStatus() — 429 -> RecordRateLimit, 5xx -> RecordFailure
- provider.go: Chat/ChatStream — wire Throttle after TryAcquire
- api.go: sourcePayload + RPM, buildSource passes RPM through
- ui/index.html: add RPM input field in source editor, bilingual i18n labels
- deploy.sh: backup old binary + rollback on healthcheck failure
- provider_test.go: TestModelStateRateLimitShortCooldown, TestThrottleSpacingAndCancel
- config.yaml: sensenova rpm: 12

internal/config/config.go

@@ -62,6 +62,7 @@ type Source struct {
 	Timeout       time.Duration          `yaml:"timeout" json:"-"`
 	MaxConcurrent int                    `yaml:"max_concurrent" json:"max_concurrent"`
 	QueueTimeout  time.Duration          `yaml:"queue_timeout" json:"-"`
+	RPM           int                    `yaml:"rpm" json:"rpm,omitempty"` // optional requests-per-minute cap (0 = unlimited)
 }
 
 // Load reads and validates a config file. When the file does not exist yet a