feat: rate limiting, shared DB instance, TCP_NODELAY fix

- Add rate limiter to TCP and HTTP servers
- Share single LSMTree between TCP and HTTP servers
- Replace unsafe cast[string]/cast[seq[byte]] with safe helpers
- Stabilize gossip UDP socket with exponential backoff
- Fix TCP_NODELAY via low-level setSockOptInt(IPPROTO_TCP)
  (asyncnet.setSockOpt(OptNoDelay) uses SOL_SOCKET and fails)
- Apply TCP_NODELAY to server and websocket sockets

docs/en/protocol.md

@@ -11,6 +11,11 @@ BaraDB supports multiple protocols for client communication:
 
 The binary protocol uses big-endian encoding for all multi-byte values.
 
+### Connection Optimizations
+
+- **TCP_NODELAY** — Enabled on both server and client sockets to minimize latency for small messages (queries, acks). This disables Nagle's algorithm, ensuring packets are sent immediately without buffering.
+- **Rate Limiting** — Token-bucket rate limiter is integrated at the protocol level. Queries exceeding the rate limit receive error code 429.
+
 ### Connection Lifecycle
 
 ```
@@ -142,6 +147,18 @@ printf '\x00\x00\x00\x12\x01\x02\x00\x00\x00\x00\x08SELECT 1' > /dev/tcp/localho
 
 Base URL: `http://localhost:9470/api/v1`
 
+### Rate Limiting
+
+All query endpoints (`/query`, `/batch`) are protected by a token-bucket rate limiter:
+- **Global rate** — Configured via `BARADB_RATE_LIMIT_GLOBAL` (default: 10,000 requests/minute)
+- **Per-client rate** — Configured via `BARADB_RATE_LIMIT_PER_CLIENT` (default: 1,000 requests/minute)
+- **Client identification** — Uses `X-Forwarded-For` header when behind a proxy, otherwise uses a global key
+
+When rate-limited, the server returns HTTP 429 with:
+```json
+{"error": "Rate limit exceeded"}
+```
+
 ### Endpoints
 
 #### Health