refactor(abuse)!: make adapters immutable - #14056

Adds the readonly Adapter with withParams/key, the Result value object, the
TimeLimit base with a now() clock seam, and the Redis/RedisCluster/RedisPool/None
adapters behind a shared RedisBase that hits through one atomic Lua script.
Unit tests drive the base through an in-memory adapter with a movable clock.

…utable contract

hit() now returns the pre-hit count and only writes below the limit, count() is a read-only lookup, and nothing is cached on the instance so withParams() clones stay correct across windows.

Window and elapsed fraction are derived from a now() seam on every call, so a reused instance never carries stale window state; the Lua script returns the pre-hit estimate so Result can be built uniformly across algorithms.

Adapters no longer cache the timestamp or bucket state, so a reused or cloned instance always reads a fresh refill. check() returns a Result, and both Lua scripts return the integer tokens used before the call, with every key passed in KEYS for Dragonfly. The refillRate guard now applies only when tokens > 0, so limit 0 (unlimited) can be built from limit / interval.

ReCaptcha never fit the rate-limit Adapter contract (reset/getLogs/cleanup all threw), so it becomes a final readonly verifier with an injectable PSR-18 client, defaulting to utopia-php/client over cURL. The package now targets PHP 8.5 and the README examples follow the immutable withParams()/Result API.

Cover remaining, peek, reset time, withParams isolation and window rollover on a single instance; align assertions to window starts so clock-sensitive checks cannot straddle a boundary.

…ch to immutable API

Reuse one adapter instance across windows and refills so the suites catch state frozen at construction, and cover withParams clones counting independently.

Callers now pass params through withParams() clones and read check()/peek() Results, so headers come from one atomic round trip instead of separate remaining()/limit()/time() reads, and key/API-key paths emit headers via peek() without recording a hit.

…TokenBucket

Match TimeLimit\RedisBase so a broken eval surfaces instead of silently allowing the request; fail-open stays the job of subclasses that override eval (e.g. Cloud Pool breakers).

The pool suites prefix keys in getAdapter, so hard-coded keys failed RedisPoolTest and RedisPoolClusterTest.

…g readers

The immutable rewrite typed the scan and log replies that the 44 baseline entries covered.

Each check now reads the clock, so three database round trips in a one-second window could straddle a second boundary on a cold MySQL and flake testStaticKey.