feat(limits): 限流器过期键周期清扫（内存上限铁律）

LoginLimiter._fails 与 rate_limit._buckets 只增不删——懒清理只覆盖被
回访的键，扫号换 IP/设备轮换产生的键永不被回访 → 进程长跑缓慢累积。
两处各加 sweep()（全表清「全部时间戳均已出窗」的键，窗沿 <= 与既有
保留判据 t > now - W 同沿），main.lifespan 起周期任务（300s loop）
启动创建/关停取消（cancel 后 await 落地，不留 pending task）。

Co-Authored-By: Claude Code <noreply@anthropic.com>

app/engine/services/rate_limit.py

@@ -39,5 +39,21 @@ def check(
     return True
 
 
+def sweep(now: float | None = None) -> int:
+    """Sweep expired buckets (spec 2026-10-19 §7 memory cap): drop keys whose
+    timestamps have ALL left the window (boundary inclusive, matching check()'s
+    keep predicate ``t > now - WINDOW``); return the number removed.
+
+    Companion to check()'s per-key lazy pruning: keys never revisited (client
+    churning tenant/ip/device_id) would otherwise accumulate forever; called
+    by main.lifespan's periodic task."""
+    now = time.time() if now is None else now
+    dead = [k for k, ts in _buckets.items()
+            if not ts or ts[-1] <= now - WINDOW]
+    for k in dead:
+        del _buckets[k]
+    return len(dead)
+
+
 def _reset_for_test() -> None:
     _buckets.clear()