#29 SEC-1: Redis Rate Limiting & API Security

Enforce per-tenant and per-key rate limits via Redis. Enforce 1MB max JSON body. Protect Webhooks against SSRF. Apply resilient_circuit policies. (UB-API-8, UB-SEC-3, UB-SEC-4, UB-TECH-6, UB-NF-10)