The IngressRequestRateLimiter (IRRL) rejects excess ingress requests early with a SystemOverloaded reply, but each rejection still pays to serialize, compress, checksum, TLS-encrypt, and socket-write the response. Under sustained overload the server can spend a growing fraction of CPU simply writing rejection replies to clients it has already decided to reject, which competes with useful work and can amplify the overload, with no independent lever to bound it.
 
This ticket introduces an egress response rate limiter, which is a thin wrapper over an admission::RateLimiter, present at both shard and router entry points. The limiter paces egress IRRL rejection replies for user/application connections only (excluding DBDirectClient, priority-port, and cluster-internal traffic), with an unbounded queue so a response is never denied.