chore: merge executor worktree (06-05) — trusted-proxy rate limiting + per-account limiter

Resolved merge conflicts:
- backend/main.py: keep both setup_logging (06-02) and account_limiter (06-05) imports
- backend/tests/test_rate_limiting.py: take 06-05 version (all 8 xfails promoted)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/services/rate_limiting.py

@@ -0,0 +1,17 @@
+"""Per-account rate limiter shared across document and cloud routers (D-12)."""
+from __future__ import annotations
+
+from fastapi import Request
+from slowapi import Limiter
+
+
+def _account_key(request: Request) -> str:
+    user = getattr(request.state, "current_user", None)
+    if user is not None:
+        return str(user.id)
+    if request.client:
+        return request.client.host
+    return "anonymous"
+
+
+account_limiter = Limiter(key_func=_account_key)