fix: separate session read rate limits

[korone00]

Summary

• classify read-only session checks under the runtime request budget
• preserve the strict authentication budget for authentication mutations
• add generated-app regression coverage and update the rate-limit documentation

Verification

• npm test -w @podosoft/podokit
• npm run lint -w @podosoft/podokit
• npm run build -w @podosoft/podokit
• generated PDSPEC application rate-limit Playwright spec