Limit bootstrap secret downloads and clarify Cloudflare guidance

[edgepillar]

Summary

• Bound authenticated bootstrap secret downloads per node token and return 429 with Retry-After after the quota is reached. Existing bearer authentication, node-type checks, and other bootstrap routes remain unchanged.
• Correct the dashboard/API guidance for customer-uploaded Authenticated Origin Pulls certificates.
• Scope the proposed CF-Connecting-IP follow-up to client-IP attribution and rate limiting on ordinary proxied requests, not identity or authentication.

Validation

• npm run typecheck
• npm run build
• npm test (94 passed, 1 skipped because a Go toolchain is unavailable)
• Local HTTP regression coverage for unauthorized and wrong-type requests, per-token quota isolation, both pillar and seed secret routes, 429, and Retry-After.

Scope

This follows up the remaining review comments on #9. The changes were tested locally. No Cloudflare settings or origin deployment were changed, and no live origin behavior was verified.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}