Clio PR2 review fixes: wire proactive rate-limit backoff + deterministic tests

Independent review (#63): security paths passed; two should-fixes + three nits.

SHOULD-FIX 1 (chosen: WIRE, not delete) - proactive backoff was exported and
tested but never called. Now clioRequest records a per-bucket backoff when a
response reports X-RateLimit-Remaining 0 + a Reset, and the next call for that
bucket waits until reset (capped 5s) or fails fast with the fixed rate-limit
message. Added parseRateLimitResetMs (epoch/delta tolerant) + 3 tests
(reset parsing, over-cap fail-fast without a second request, within-cap
wait-then-proceed under fake timers).

SHOULD-FIX 2 - deterministic CI: the scrypt-heavy Clio suites (connections,
client, oauth, manageTools, growTools) now raise testTimeout to 20s with the
#61-style explanatory comment, so real scryptSync under 43 parallel files can't
flake the 5s default.

NITS: BUILD_LOG test counts → 589/589 (76 new); "presigned PUT/download" →
"presigned PUT never carries the bearer (no document download is implemented)";
added a line that migration 20260803_01 was already run in production 03/08 so
the connector activates on deploy (code stays 42P01-tolerant regardless).

Verified: tsc clean; prettier clean; full suite run TWICE back-to-back, both
589/589 green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>