fix: rate limiter memory pruning in Check(), services error leakage replaced with generic messages

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/mw/ratelimit.go

@@ -50,7 +50,7 @@ func NewProgressiveRateLimiter() *ProgressiveRateLimiter {
 // Check returns the delay in milliseconds. Returns 0 if no delay needed.
 // Strategy:
 //   - Count requests in last 5 seconds (burst): allow up to 30
-//   - Count requests in last 60 seconds (sustained): allow up to 60
+//   - Count requests in last 60 seconds (sustained): allow up to 120
 //   - Only delay when BOTH windows are exceeded (high sustained rate with recent bursts)
 //   - Progressive: once throttled, delay increases with sustained rate
 func (prl *ProgressiveRateLimiter) Check(ip string) (delayMs int) {
@@ -68,6 +68,15 @@ func (prl *ProgressiveRateLimiter) Check(ip string) (delayMs int) {
 
 	state.timestamps = append(state.timestamps, now)
 
+	cutoff := now.Add(-60 * time.Second)
+	pruned := state.timestamps[:0]
+	for _, t := range state.timestamps {
+		if t.After(cutoff) {
+			pruned = append(pruned, t)
+		}
+	}
+	state.timestamps = pruned
+
 	burstCutoff := now.Add(-5 * time.Second)
 	burstCount := 0
 	for _, t := range state.timestamps {