Rate limits: make them filterable and log when they trigger #60

The auth rate limits are hard-coded, and nothing records when one triggers. When customers report "too many requests", there's no way to see which bucket stopped them or to tune it for a site behind a proxy or a support desk.

Fix

• A filter per bucket on the policy TieredRateLimiter uses (limit and window), e.g. workos_rate_limit_policy( array $policy, string $bucket ). Defaults unchanged.
• When a request is limited:
  • fire workos_rate_limited( string $bucket, string $subject_hash, int $retry_after );
  • write an activity-log entry with the bucket and a hashed subject, never the raw email or IP.
• Document the buckets and their defaults in docs/.

Done when

• The filter changes the limit a request sees.
• A limited request fires the action once and logs once.
• Tests cover both.