ProxyHelpers::ProxyLimiter

Channel-free semaphore: global cap + per-host sub-cap. Acquisition is non-blocking — if a slot is unavailable it raises CapExceeded immediately (caller maps that to a 503 with Retry-After). Implemented as counter + mutex for clarity; the alternative (nested Channel#send_select) is harder to read and offers nothing for our use case where the caller wants the back-pressure signal NOW, not whenever a slot frees up.