refactor(rate-limit): 限流架构升级为双层滑动窗口，新增IP全局防护与响应头

限流算法从 INCR+EXPIRE 固定窗口升级为 ZSET+Lua 滑动窗口，
新增 IpRateLimitFilter 提供 IP 全局防护（默认 1000次/60s）。
新增 X-RateLimit-Limit/Remaining/Reset 响应头与 Retry-After，
新增 rate-limit.ip.* 配置项控制 IP 全局开关与阈值，
@RateLimit 空注解统一走全局配置，消除硬编码。

src/main/java/com/youlai/boot/auth/controller/AuthController.java

@@ -48,7 +48,7 @@ public class AuthController {
     @Operation(summary = "账号密码登录")
     @PostMapping("/login")
     @Log(module = LogModuleEnum.LOGIN, value = ActionTypeEnum.LOGIN)
-    @RateLimit(limit = 5, window = 60)
+    @RateLimit
     public Result<AuthenticationToken> login(@RequestBody @Valid LoginForm request) {
         AuthenticationToken authenticationToken = authService.login(request.getUsername(), request.getPassword());
         return Result.success(authenticationToken);

src/main/java/com/youlai/boot/auth/controller/WxMaAuthController.java

@@ -50,7 +50,7 @@ public class WxMaAuthController {
     @Operation(summary = "静默登录", description = "通过微信 code 登录，已绑定用户直接返回 token，未绑定用户返回 openid 需绑定手机号")
     @PostMapping("/silent-login")
     @Log(module = LogModuleEnum.LOGIN, value = ActionTypeEnum.LOGIN)
-    @RateLimit(limit = 10, window = 60)
+    @RateLimit
     public Result<WxMaLoginVO> silentLogin(
             @Parameter(description = "微信登录凭证（wx.login 获取）", required = true, example = "0xxx")
             @RequestParam String code
@@ -69,7 +69,7 @@ public class WxMaAuthController {
     @Operation(summary = "手机号快捷登录", description = "同时使用微信 code 和手机号授权 code 登录，适用于企业认证小程序")
     @PostMapping("/phone-login")
     @Log(module = LogModuleEnum.LOGIN, value = ActionTypeEnum.LOGIN)
-    @RateLimit(limit = 5, window = 60)
+    @RateLimit
     public Result<AuthenticationToken> phoneLogin(@Valid @RequestBody WxMaPhoneLoginForm req) {
         AuthenticationToken result = wxMaAuthService.phoneLogin(req.getLoginCode(), req.getPhoneCode());
         return Result.success(result);
@@ -85,7 +85,7 @@ public class WxMaAuthController {
     @Operation(summary = "绑定手机号", description = "为静默登录用户绑定手机号，绑定成功后自动登录")
     @PostMapping("/bind-mobile")
     @Log(module = LogModuleEnum.LOGIN, value = ActionTypeEnum.LOGIN)
-    @RateLimit(limit = 3, window = 60)
+    @RateLimit
     public Result<AuthenticationToken> bindMobile(@Valid @RequestBody WxMaBindMobileForm req) {
         AuthenticationToken result = wxMaAuthService.bindMobile(req.getOpenid(), req.getMobile(), req.getSmsCode());
         return Result.success(result);