identity verification + funded/BYOM credentials + rate limiting

Backend-only slice — the CakePHP /chat/token route itself is deliberately deferred to a follow-up (framework repo change, out of scope here). Adds to chat-backend:

• auth/verify.ts — verifies a CakePHP-issued identity token (HMAC/JWT), fails closed to anonymous on any error
• llm/credentials.ts — the single chokepoint deciding BYOM key vs CDLI's funded key (logged-in only, pinned to mistral-small-latest, ignores any other requested provider/model)
• ratelimit/limiter.ts + budget.ts — tiered per-minute rate limits (anon/BYOM, user/BYOM, user/funded) and a daily funded-usage cap, both in-memory for now (no Redis yet — built against a swappable store interface, see follow-up branch)
• routes/message.ts — byomKey is now optional; identity/rate-limit/credential failures return clean JSON errors before the SSE stream opens