chore: merge executor worktree (06-05) — trusted-proxy rate limiting + per-account limiter

Resolved merge conflicts:
- backend/main.py: keep both setup_logging (06-02) and account_limiter (06-05) imports
- backend/tests/test_rate_limiting.py: take 06-05 version (all 8 xfails promoted)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/main.py

@@ -23,6 +23,7 @@ from api.topics import router as topics_router
 from config import settings
 from db.session import AsyncSessionLocal, engine
 from services.logging import setup_logging
+from services.rate_limiting import account_limiter
 
 
 # ── CSP / Security headers middleware ────────────────────────────────────────