feat(kura): prioritize public cache traffic over sync

Resolves no linked issue.

Adds adaptive Kura peer artifact bandwidth shaping so background replication does not consume the same network budget as public cache traffic.

• Introduces KURA_REPLICATION_BANDWIDTH_LIMIT_BYTES_PER_SECOND as an opt-in per-node ceiling for peer artifact body transfers.
• Applies the limiter to live replication uploads, replication ingests, and bootstrap artifact body transfers while leaving public cache reads unconstrained.
• Makes the limiter dynamic by dividing the configured ceiling by the larger of public_inflight + 1 and recent public request latency pressure, using KURA_REPLICATION_PUBLIC_LATENCY_TARGET_MS as the target.
• Centralizes gRPC request accounting in a tonic server layer so every routed gRPC call contributes to public load for its full response-body lifetime, including streaming responses.
• Exposes public-load, configured/effective bandwidth, latency target, and public latency EWMA metrics, with Helm and documentation wiring.

How to test locally

• mise exec -- cargo test --lib
• mise exec -- cargo clippy --all-targets -- -D warnings
• helm template kura kura/ops/helm/kura