Enterprise gateway gets clearer rate-limit and connection diagnostics

What

• The gateway server now reads a store.connect_timeout_seconds config value, wraps its initial Postgres connection attempt in a retrying wrapper, and shows a clearer boot error naming that setting if the connection fails.
• It logs a throttled (once-per-minute) warning when sign-in rate limits (rate_limits.device_authorization.max, rate_limits.device_verify.max) are hit, and a new warning when a request carries an X-Forwarded-For header but its source isn't listed in listen.trusted_proxies.
• When the /oauth/device_authorization or /device (verify) endpoints hit these same rate limits, the response to the client now explains that the limit may be caused by shared-network noise and points admins at the specific config keys to adjust, instead of a generic "Too many attempts" message. Each rate-limited path also now fires a telemetry call.

Why These changes make it much easier for administrators running a self-hosted gateway to diagnose why sign-ins are being rate-limited or connections are failing, instead of seeing generic errors with no pointer to the relevant setting.