feat(core): add UploadStateMachine for rate limiting (1/3)

[abueide]

Summary

• Adds UploadStateMachine for managing global rate limiting state (429 responses)
• Adds RateLimitConfig, UploadStateData, HttpConfig types to types.ts
• Adds validateRateLimitConfig in config-validation.ts with SDD-specified bounds
• Core test suite (10 tests) with test helpers

Merge order

This PR merges first. PR #1152 and #1150 rebase onto master after this lands.

1. feat(core): add UploadStateMachine for rate limiting (1/3) #1153 (this) — UploadStateMachine + rate limit types
2. feat(core): add BackoffManager for transient error backoff (2/3) #1152 — BackoffManager + backoff types
3. feat(core): add error classification and default HTTP config (3/3) #1150 — Error classification + defaultHttpConfig

Components

UploadStateMachine (135 lines)

State machine managing global rate limiting for 429 responses per the TAPI SDD.

Methods:

• canUpload() — upload gate that respects rate limit wait times
• handle429(retryAfterSeconds) — sets RATE_LIMITED state with configurable retry limits
• reset() — clears rate limit state on successful upload
• getGlobalRetryCount() — returns current retry count for X-Retry-Count header

States: READY | RATE_LIMITED

Persists state across app restarts via sovran store.

Config Validation (42 lines)

Validates and clamps rate limit configuration to safe ranges:

• maxRetryInterval: 0.1s – 86,400s
• maxRateLimitDuration: 60s – 604,800s
• maxRetryCount: 1 – 100

Type Definitions (19 lines added to types.ts)

• RateLimitConfig — rate limit settings from Settings CDN
• UploadStateData — state machine persistence shape
• HttpConfig — container on SegmentAPISettings

Test plan

• 10 core tests covering canUpload gate, handle429 transitions, reset, max retry/duration limits, disabled config
• devbox run test-unit passes
• No unrelated diffs (git diff master -- .github/ scripts/ wiki/ is empty)

[abueide]

Superseded by #1154