Add rate limiting / retry for crates.io API bulk checks

When checking many crate names in parallel (20 concurrent threads), the crates.io REST API may rate-limit requests. The sparse index (CDN-backed) was more tolerant of bulk queries.

Consider adding:
- Retry with exponential backoff on 429 responses
- Configurable concurrency limit
- Optional delay between requests

Context: surfaced during PR #2 code review (switch from sparse index to API).