Adds a new module exposing TokenBucket, BucketStore, and MeteredStream.
The bucket holds capacity_bytes, refill_bytes_per_sec, and the matched
permission's not_after as immutable u64/DateTime fields. try_consume_up_to
is atomic and short-circuits to zero when the permission has expired,
making the bucket the natural mid-tunnel kill switch.

MeteredStream wraps an AsyncWrite, reserving tokens before each inner
write and refunding any tail the inner stream did not accept. This
makes overshoot impossible: tokens consumed equals bytes the inner TCP
stack confirmed accepted. Reads are delegated straight through; only
the upstream egress direction is metered.

Unit tests cover the bucket math, concurrent consume (no overshoot),
refund semantics on partial writes, retry-after computation, expiry,
the store's get-or-create contract, and the algorithmic no-overshoot
property of MeteredStream against an in-memory duplex pipe.

Mutex locks use the soft-recovery pattern (unwrap_or_else with
PoisonError::into_inner) so a panicking task cannot poison the bucket
state and bring down unrelated tunnels.

ProxyService now consults an in-process BucketStore (keyed by
permission_id) before allowing each CONNECT. If the bucket for the
matched permission is empty, return 429 Too Many Requests with a
Retry-After header computed from the bucket's refill rate. The
bucket is created lazily on first use with the signed capacity,
refill rate, and not_after from the permission row.

MakeProxyService accepts the BucketStore at construction; main.rs
instantiates it alongside the policy engine. The test harness exposes
start_proxy_with_store so integration tests can hold a reference to
the same store the proxy uses, which lets them drain or revoke
buckets without going through the tunnel.

Integration test seeds a v2 row with capacity 100, refill 0,
exhausts the bucket via the test-held store, and asserts the next
CONNECT returns 429.

spawn_tunnel now wraps the upstream TCP socket in a MeteredStream
that reserves bytes from the per-permission bucket before each
inner write and refunds anything the inner stream did not accept.
When the bucket drains mid-stream, the next write returns io::Error
and the tunnel collapses through the existing copy_bidirectional
error path. No new control flow added.

Two end-to-end tests prove the property: the first writes 4 KiB
through a tunnel with a 1 KiB bucket and asserts the destination-side
echo server received at most 1 KiB (the no-overshoot proof), then
inspects the tunnel-error structured log to confirm the rate_limit
error string. The second drains the bucket through the tunnel and
asserts a fresh CONNECT returns 429.

TokenBucket gains a revoked AtomicBool, set once via mark_revoked.
The bucket's is_dead helper now returns true for any of: tokens
exhausted, permission expired, or revoked flag set. All three flow
through the same MeteredStream::poll_write error path, so there is
no special-cased control flow per reason; the bucket is the unified
mid-tunnel kill switch.

A small background task in main.rs polls permission_registry every
30 seconds for rows with revoked_at set and calls mark_revoked on
the matching bucket. The query is read-only and respects the
gateway's read-only database role. The query function is factored
out so integration tests can invoke it directly without waiting on
the timer, which keeps the test deterministic.

Memory ordering on the revoked flag is Release on store / Acquire
on load, which makes the revocation visible to every subsequent
is_dead check across threads.

Adds unit tests for the revoked-bucket behaviour, the
BucketStore::mark_revoked lookup, and idempotency. Adds an
integration test that revokes a permission mid-tunnel and asserts
the next write fails.

…dependency

Updates the README to cover the new 429 status code with the
Retry-After header, the two signed byte-budget fields in the v2
canonical permission format, and the kill-switch behaviour now
shared between cap exhaustion, permission expiry, and explicit
revocation. Adds a section explaining the 30-second revocation
poll and the bounded latency it implies. Adds a note about the
parallel update needed in the sister demo repo's registry-cli.

The previous phrasing said the agent "cannot exfiltrate faster than
capacity_bytes + refill_bytes_per_sec × 30s after a revocation" --
strictly the units don't match (faster is a rate, not a quantity).
Rephrased to make the bound a transferred-bytes quantity and to be
explicit that the 30s is the upper bound on poll-to-mark latency,
not a fixed latency.