fix(security): add rate limiting to /config/reload endpoint

[peteroden]

Summary

Add rate limiting to the POST /config/reload endpoint to prevent abuse.

Background

During the OWASP security review of PR #281, a medium-severity finding was identified: the /config/reload endpoint has no rate limiting. While it requires X-Gitlab-Token authentication, a compromised token could be used to spam reload requests, causing excessive registry rebuilds and log noise.

Acceptance Criteria

• Rate limit POST /config/reload (e.g., max 5 requests per minute)
• Return 429 Too Many Requests with Retry-After header when limit exceeded
• Rate limit state is per-instance (no shared state needed for single-replica deployment)
• Unit tests for rate limiting behavior

Notes

• Consider using slowapi or a simple in-memory token bucket
• Keep it simple — this is a single-replica service