feat: surface Poly-RateLimit state on rate-limit errors and via on_rate_limit_update

[kartojal]

Implements DEV-481.

• RateLimitError now carries retry_after (from Retry-After, matching RequestRejectedError) and rate_limit, the Poly-RateLimit-* state reported with a 429 rejection.
• New on_rate_limit_update option on SecureClient.create / AsyncSecureClient.create: a listener invoked whenever a response reports per-signer rate-limit state (remaining, reset, tier, warning), including warning-mode monitoring before live enforcement.

https://linear.app/polymarket/issue/DEV-481

---

Note

Low Risk
Additive API and optional callback; RateLimitError gains optional fields with defaults, so existing catch/retry logic should remain compatible.

Overview
Adds per-signer rate-limit visibility from Polymarket Poly-RateLimit-* response headers.

HTTP transports parse those headers on every response and optionally invoke an on_rate_limit_update callback with a RateLimitUpdate (remaining, reset, tier, warning). Listener failures are logged and do not fail the request. SecureClient.create / AsyncSecureClient.create accept this listener and wire it to the CLOB transports used for trading.

RateLimitError on HTTP 429 now includes retry_after (from Retry-After, aligned with RequestRejectedError) and rate_limit parsed from the same headers. New public types RateLimitUpdate and RateLimitUpdateListener are exported from the package root.

^{Reviewed by Cursor Bugbot for commit 2c9cda3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[naruto11eth]

Approved. One consumer-facing note: the listener type is sync and runs inline on the response path, so on AsyncSecureClient a slow callback blocks the event loop. Fine as a contract, just worth a line in the docstring saying callbacks must stay fast and non-blocking. And a small test gap if you're touching it again: the async transport has no 429/listener-isolation tests and the header parser has no malformed-value cases (Poly-RateLimit-Remaining: abc).