Emit RateLimitRejected security events for all four OAuth rate-limit policies #1164

Context

At main bd4e5eca, OAuth limits return 429 but emit no RateLimitRejected security event. The global rejection callback logs that event only for login and refresh policies: src/Cluckwork.Api/Hosting/CluckworkRateLimitingServiceCollectionExtensions.cs:91. The same file registers the four OAuth policies at lines 131–157.

PR #1136's deferred-work section records the missing events. Its merge-update comment confirms all four policies: oauth-authorize, oauth-token, oauth-register and oauth-api. The deferred-work section says three, but the merged code has four.

This is an observability gap. The rate limits already work.

Acceptance criteria

• Each rejected request under those four policies emits exactly one warning with the existing SecurityEvents.RateLimitRejected value (Auth.RateLimitRejected). Include the policy name, client IP and request path as structured properties.
• Select the event by the endpoint's attached policy, not a list of URL paths.
• Keep the existing 429 response, Retry-After, limits and partition keys unchanged. Login/refresh logging still works; client-errors rejections still emit no security event.
• Do not log bearer tokens, authorization codes, PKCE verifiers, passwords, request bodies or query strings.
• Integration tests drive actual rejections for all four policies and inspect the captured events. Use a test-only AcceptOAuthTokens endpoint for oauth-api; no MCP endpoint is required. Include allowed-request and client-errors controls.

Suggested labels: bug, area:api, severity:p3, size:S.