fix: rate limiter cleanup on a time interval, not just key count

[Jaro-c]

This addresses the RateLimiterService half of #77, not the player.local.ts half — see my comment on the issue for why I split it.

checkLimit only ran cleanup() once this.hits.size > 5000. Bursty player churn across many clientId:class:method keys could transiently grow memory before that threshold is ever reached. Added a time-based trigger alongside the existing size one — cleanup now also runs if more than 60s have passed since the last one, regardless of key count.

Added a test file for this service (there wasn't one) covering the basic limit/window behavior and the new interval-based cleanup trigger via fake timers.

pnpm test, pnpm typecheck, and pnpm check all pass.

Refs #77.