feat: add rate limiting and metrics (Issues #6, #3)

[avrabe]

Summary

Implements both remaining open issues in a single PR:

Rate Limiting (Issue #6)

• RateLimiter with sliding window algorithm
• RetryPolicy with exponential backoff
• Server rate limit header parsing (X-RateLimit-*, Retry-After)
• Default limits: Fulcio 10/min, Rekor 20/min, OIDC 5/min
• New error variants: RateLimitExceeded, RateLimitedByServer

Metrics (Issue #3)

• SigningMetrics with atomic counters
• LabeledCounter for failure tracking by reason
• Histogram for latency percentiles
• Prometheus exposition format export
• Global metrics instance via global_metrics()

Design Decisions

• No external dependencies - uses only std (atomic counters, HashMap)
• Lightweight - ~800 lines total, well-documented
• Thread-safe - all types are Send + Sync
• Prometheus-compatible - standard exposition format

Test plan

• Rate limiter unit tests (window, blocking, reset)
• Retry policy tests (backoff calculation, caps)
• Metrics counter tests
• Histogram tests
• Prometheus export format tests
• All 523 existing tests pass

Closes #6
Closes #3