fix: keep read refreshes outside write burst

[Minorli]

Summary

• keep all business API requests under the per-minute limit
• apply the five-second burst limit only to mutating requests
• prevent normal result refresh and workspace reload GETs from returning 429
• release PicGen 0.1.61

Test plan

• 396 pytest tests passed
• 87% coverage (fail-under 80)
• explicit tests cover write burst, read refresh, mixed GET/POST, and read minute limits
• Ruff, Mypy, Node syntax, Shell syntax, Compose config, uv lock, diff check passed
• pip-audit reported no known dependency vulnerabilities
• independent review: no remaining findings