[P2][security] n8n API client: no rate limiting / concurrency control / Retry-After handling

[Toqsick]

Source: RepoLens Security-Audit 2026-08-16 (finding security/rate-abuse/002, adversarial-verified ✅)

n8n_api.py/_request and n8n_tester.py polling have zero sleep/429/throttle handling (grep for rate/throttle/Retry-After/Semaphore returns empty).

Suggested fix: token-bucket or fixed-window limiter + honor Retry-After on 429.

[Toqsick]

Triage 2026-08-16: ProjectZomboiD #3–#7 sind heute gefixt und geschlossen (PR #8). my-agent-tools-Härtung ist das nächste RepoLens-Backlog, geplante Reihenfolge: #9 (Path-Traversal) → #8 (Skill-Docs) → #7 (Security-Header) → #6/#5 (Rate-Limiting). Die Visibility-Entscheidung (public vs. private) fällt nach der Härte-Runde.