feat: key IdP account upsert on PID and remove rate limiter

[naasanov]

This PR resolves two related backend cleanups: switching the account uniqueness key used during IdP login to PID, and removing the in-app rate limiter now that a reverse proxy is being introduced.

Changes:

• Key the student IdP account upsert (upsert_idp_account) on pid instead of onyen when looking up an existing account, treating PID as the stable identity and overwriting onyen from the IdP payload — consistent with how provision_staff_account already matches staff by PID (onyen -> PID for keying #466)
• Remove the slowapi rate limiter from main.py (limiter setup, exception handler, and SlowAPIMiddleware) and drop the slowapi dependency from backend/pyproject.toml, since the new reverse proxy will handle rate limiting (Remove Rate Limiter #467)
• Update auth exchange tests to reflect PID-based matching

Closes #466
Closes #467

🤖 Generated with Claude Code

[github-actions]

Test Results Summary

856 tests  ±0   856 ✅ ±0   1m 0s ⏱️ -9s
  1 suites ±0     0 💤 ±0 
  1 files   ±0     0 ❌ ±0 

Results for commit f3e58da. ± Comparison against base commit f58b5c2.