feat: Redis rate limits + streaming paste upload

[ArianAr]

Summary

Implements v1.3.1 / #32 and v1.3.3 / #33.

Redis rate limits

• REDIS_URL → shared fixed-window counters (papercut:rl:*)
• Falls back to in-memory sliding window if unset or Redis errors
• checkRateLimit(scope, key) used by create + unlock

Streaming upload

• POST /api/pastes with text/plain or application/octet-stream
• Optional headers: X-PaperCut-Expire, X-PaperCut-Password
• Size-capped streaming read (MAX_PASTE_SIZE)
• CLI streams stdin (no JSON stringify of entire log)

Test plan

• Server unit + integration (incl. text/plain create, rate limit mock)
• CLI upload tests (JSON + stream headers)
• typecheck + lint

Closes #32
Closes #33

[ArianAr]

Review

Summary: Practical multi-node RL via optional Redis with safe fallback. Streaming path avoids huge JSON bodies; size limit enforced while reading. CLI duplex stream usage matches Node undici requirements. Password header only for CLI private path (already env-based).

Verdict: LGTM once CI green.