feat(security): Origin load-shedding guard — PR4 (#2271)

[jung-thomas]

Implements #2271: load-shedding guard on the HANA content-serve path.

What

• In-flight concurrency guard on anonymous /content/tutorials/:slug GET
• Sheds with 503 + Retry-After when ceiling exceeded
• Config (ceiling, Retry-After) via ImsConfig key/value (~5s cache)
• Feature flag LOADSHED_ENABLED (DB-gated, default OFF)
• Fail-open: guard errors never block content

Files

• srv/lib/load-shed.js: concurrency guard (acquireServeSlot)
• srv/lib/runtime-config/load-shed-settings.js: numeric config resolver
• srv/lib/content-store.js: wire guard into serveStoredSlug after cache-miss
• srv/lib/feature-flags/registry.js: LOADSHED_ENABLED flag entry
• .deploy/mta.yaml: srv-qa cp-list updated
• test/unit/load-shed.test.js: unit tests (8 cases)
• test/lib/content-store.test.js: serve-path integration (2 cases)

Testing

• All 8 unit tests pass (guard, config, fail-open, idempotency)
• Serve-path integration: shed→503+Retry-After, release on success
• Registry + srv-qa cp-list drift tests pass
• Full suite: 1313 passed (no regressions)

Rollout

• Default OFF; enable on DEV for observation
• Observe in-flight patterns, then roll to PROD

---

Follows PR1 (#2263), PR2 (#2264), PR3 (#2270).