Fix grpcserver rate limiter: move to Server field

The package-level defaultRateLimiter drained its token bucket
across all test cases, causing later tests to hit ResourceExhausted.
Move rateLimiter from a package-level var to a *grpcRateLimiter field
on Server; New() allocates a fresh instance (10 req/s, burst 10) per
server. Each test's newTestEnv() constructs its own Server, so tests
no longer share limiter state.

Production behaviour is unchanged: a single Server is constructed at
startup and lives for the process lifetime.

web/static/htmx.min.js

@@ -0,0 +1,2 @@
+/* htmx placeholder — replace with actual htmx.min.js from https://unpkg.com/htmx.org */
+console.warn("MCIAS: htmx.min.js is a placeholder. Replace with the real htmx library.");