fix: preserve authentication limits in fallback composition

[Lucenx9]

Summary

Preserves the configured authentication rate-limit defaults when application composition is invoked without an explicit rate-limit policy.

The fallback previously reused the API-key burst of 30 for authentication, while loadConfig() defines an authentication burst of 60. This caused authentication-heavy E2E flows to receive an unintended 429 RATE_LIMITED response.

Changes

• add the missing 600 requests/minute and burst-60 authentication fallback values;
• add a composition regression test that sends 61 valid-format unknown credentials and proves 60 authentication attempts are evaluated before the 61st is rate-limited;
• preserve the existing account/API-key limits and burst.

Validation

• regression test: red at 30 × 401 / 31 × 429 before the production fix; green at 60 × 401 / 1 × 429 after it;
• GitHub-ingestion E2E in isolation: 3 passed;
• complete E2E grouping: 92 passed;
• full bounded offline suite: 651 passed, 7 expected environment-gated skips, 0 failures;
• formatting, ESLint, strict typecheck, build, migrations (including idempotent rerun), catalog and advisory verification passed;
• git diff --check passed.