Sliding-window rate limiter (30 req/min per peer origin) on POST /api/federation/relay, matching the existing accept endpoint pattern. Returns 429 when exceeded — outbox workers retry with backoff. Check runs before HMAC verification to avoid wasted computation on floods.