Use rate limiter policy classes and drop the /api/reading path bypass #1604

The reading API rate limits are inline lambdas with magic numbers, and the global limiter special-cases /api/reading with a no-limiter bypass, so unrouted requests under that path are unlimited. The repo convention is policy classes (ContentRateLimiterPolicy, McpRateLimiterPolicy). Extract policies, name them accurately (GET profile currently uses a 'Write' policy), and use RequireRateLimiting/named policies instead of a path bypass.

Found during review of #1267; intentionally kept out of that PR.