Agent rate limits and backoff contract

# 429 response (headers also present on 200 responses)
HTTP/1.1 429 Too Many Requests
RateLimit-Limit: 30
RateLimit-Remaining: 0
RateLimit-Reset: 45                  # seconds until the window resets
Retry-After: 45                      # seconds
Content-Type: application/json

{
  "ok": false,
  "error": "Rate limit exceeded. Try again in a minute."
}

# Notes:
# - Standard draft headers are emitted (RateLimit-*), not X-RateLimit-*.
# - Some endpoints emit a plain text message body instead of JSON — handle
#   both by checking Content-Type before parsing.

# anonymous lane
{
  "lane": "anonymous",
  "identity_key": "a1b2c3d4e5f6...",
  "schema_version": "certifieddata.quota.v1",
  "buckets": {
    "demo_window":              { "limit": 10, "remaining": 7, ... },
    "public_verify_window":     { "limit": 60, "remaining": 58, ... },
    "sandbox_key_daily":        { "limit": 3, "remaining": 3, ... },
    "sandbox_key_global_window":{ "limit": 60, "remaining": 60, ... }
  },
  "lanes_available": ["anonymous", "agent", "authenticated"]
}

# agent lane (with X-Agent-DID: did:cd:agent:ci-runner-prod-01)
{
  "lane": "agent",
  "identity_key": "f9e8d7c6b5a4...",       // hash of DID
  "did_status": "did_accepted",
  "agent_did_rotation": {
    "unique_dids_in_window": 1,
    "max": 10,
    "reset_at": "2026-04-25T19:00:00.000Z",
    "window_seconds": 3600
  },
  "buckets": {
    "demo_window":          { "limit": 60, "remaining": 60, ... },
    "public_verify_window": { "limit": 240, "remaining": 240, ... },
    "sandbox_key_daily":    { "limit": 30, "remaining": 30, ... },
    ...
  }
}

// TypeScript exponential backoff pattern
async function withBackoff<T>(fn: () => Promise<Response>, maxAttempts = 6): Promise<T> {
  for (let i = 0; i < maxAttempts; i++) {
    const res = await fn();
    if (res.ok) return res.json() as Promise<T>;

    if (res.status === 429 || res.status === 503) {
      const retryAfter = Number(res.headers.get("Retry-After")) || 2 ** i;
      const jitter = Math.random() * 500;
      await new Promise((r) => setTimeout(r, retryAfter * 1000 + jitter));
      continue;
    }
    throw new Error(`non-retryable: ${res.status}`);
  }
  throw new Error("max attempts");
}