refactor: extract shared rate limiter types into ratelimit_shared.go

Move RateLimiter, ProgressiveRateLimiter, and cleanup functions to ratelimit_shared.go. Add dev and prod rate limiter tests. Remove inline cleanup goroutines.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/mw/ratelimit_dev.go

@@ -5,10 +5,35 @@ package mw
 
 import (
 	"net/http"
-	"sync"
 	"time"
 )
 
+func NewRateLimiter(limit int, window time.Duration) *RateLimiter {
+	rl := &RateLimiter{
+		requests: make(map[string][]time.Time),
+		limit:    limit,
+		window:   window,
+	}
+	registerLimiter(rl)
+	return rl
+}
+
+func (rl *RateLimiter) Allow(key string) bool { return true }
+
+func NewProgressiveRateLimiter() *ProgressiveRateLimiter {
+	return &ProgressiveRateLimiter{
+		requests: make(map[string]*ipProgressiveState),
+	}
+}
+
+func (prl *ProgressiveRateLimiter) Check(ip string) int { return 0 }
+
+func ProgressiveRateLimit(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		next.ServeHTTP(w, r)
+	})
+}
+
 func RateLimit(limit int, window time.Duration) func(http.Handler) http.Handler {
 	return func(next http.Handler) http.Handler {
 		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
@@ -16,29 +41,3 @@ func RateLimit(limit int, window time.Duration) func(http.Handler) http.Handler
 		})
 	}
 }
-
-type ProgressiveRateLimiter struct {
-	requests map[string]*ipProgressiveState
-	mu       sync.RWMutex
-}
-
-type ipProgressiveState struct {
-	timestamps []time.Time
-}
-
-func NewProgressiveRateLimiter() *ProgressiveRateLimiter {
-	return &ProgressiveRateLimiter{
-		requests: make(map[string]*ipProgressiveState),
-	}
-}
-
-func (prl *ProgressiveRateLimiter) cleanup() {}
-func (prl *ProgressiveRateLimiter) Check(ip string) int { return 0 }
-
-var globalProgressiveLimiter = NewProgressiveRateLimiter()
-
-func ProgressiveRateLimit(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-		next.ServeHTTP(w, r)
-	})
-}