refactor(server): dedupe federation rate limiters and response signing (#10)

Phase C cleanup follow-up to the routes/federation split (#9). Behavior-
preserving; full server suite (790 tests) green.

A) rateLimits.ts: the four near-identical sliding-window limiters
   (accept/relay/lookup/ensure) and their duplicated prune loops collapse
   into one createLimiter(windowMs, max) factory. Per-call and periodic-
   sweep semantics are preserved exactly, including that lookup buckets are
   pruned per-call but never swept (unchanged from before). 177 -> 101 lines.

B) Extract sendSignedJson(reply, payload, hmacSecret) — the single
   definition of how this instance signs an S2S JSON response — and use it
   in the /epoch and /verify-attach-proof|reattach handlers, replacing two
   copies of the build-headers-and-send boilerplate.

packages/server/src/routes/federation/handlers/relay.ts

@@ -1,7 +1,8 @@
 import path from 'node:path';
 import { config } from '../../../config.js';
 import { getDb, getRawDb, schema } from '../../../db/index.js';
-import { buildFederationHeaders, getOurOrigin, parseFederationHeaders, verifyPeerSignature } from '../../../utils/federationAuth.js';
+import { getOurOrigin, parseFederationHeaders, verifyPeerSignature } from '../../../utils/federationAuth.js';
+import { sendSignedJson } from './signedResponse.js';
 import { getInstanceId } from '../../../utils/federationEpoch.js';
 import { getDmParticipants } from '../../../utils/federationOutbox.js';
 import { deleteAttachmentFiles } from '../../../utils/fileCleanup.js';
@@ -285,15 +286,7 @@ export function registerRelayRoutes(app: FastifyInstance): void {
       }
 
       // 4. Sign the response body with the peer's shared secret and return it.
-      const responseBody = JSON.stringify({ instanceId: getInstanceId() });
-      const sigHeaders = buildFederationHeaders(responseBody, peer.hmacSecret, getOurOrigin());
-      reply.headers({
-        'X-Federation-Signature': sigHeaders['X-Federation-Signature'],
-        'X-Federation-Timestamp': sigHeaders['X-Federation-Timestamp'],
-        'X-Federation-Nonce': sigHeaders['X-Federation-Nonce'],
-        'Content-Type': 'application/json',
-      });
-      return reply.code(200).send(responseBody);
+      return sendSignedJson(reply, { instanceId: getInstanceId() }, peer.hmacSecret);
     },
   );