Add an admin endpoint to reset a key's limiter state

"A customer got wrongly throttled" is a routine support request, not an edge case -- shared office IPs, a customer's own retry storm, a bug on their side that looked like abuse from ours. Today the only remediation is "wait it out" or "restart the service" (which resets every customer's state, a blast-radius mismatch nobody should accept just to unblock one account). Every minute that customer is stuck is a minute of them unable to use the product, and every restart-as-a-fix is itself a minor self-inflicted incident. An operator-facing reset endpoint turns a multi-team escalation into a 30-second fix.

Once a key is rate-limited, there is no way to clear its state short of waiting out the window/refill, or restarting the process (memory backend) / manually deleting the Redis key with redis-cli (Redis backend). A Resetter contract has been added as scaffolding in pkg/ratelimit/limiter.go (Reset(ctx, key) error), but nothing implements it yet.

Exhaust a rule's limit for a given key via repeated POST /api/v1/check calls. POST /api/v1/reset with {"rule": "...", "key": "..."} // got: 404 -- the route does not exist yet // want: 204, and the next check for that key behaves as if it were never used

Every production rate limiter needs an operator escape hatch. Without one, "a customer got wrongly throttled" turns into "wait or restart the service," neither of which is acceptable for anything but a toy.

Memory implementations: the state lives in a sync.Map (buckets/entries) keyed by the same string key Allow/AllowN use -- Reset just needs to delete that entry so the next access recreates a fresh one via the existing LoadOrStore path already in AllowN. Redis implementations: Reset is a DEL on prefix + key, mirroring how the Lua scripts build their key -- check what your redis.Scripter field actually gives you access to, and whether the field type needs to change to expose Del without breaking the existing constructors' call sites in internal/rules/rules.go. Wire the new route in internal/api/router.go next to POST /api/v1/check, and the handler in internal/api/handlers.go next to handleCheck.