perf(api): skip Autumn multiplier fetch when a rate-limit override applies

buildAuthenticatedRateLimiter awaited autumnService.getRateLimitMultiplier
on every authenticated request, even when an org override for the mode made
getAutumnRateLimiter discard the result. Resolve the override first via the
now-exported getRateLimitOverride and pass a neutral multiplier of 1 when one
exists, so an overridden endpoint no longer pays for an Autumn entity fetch.

getAutumnRateLimiter still receives the flags and remains the single place
that decides the final limit; the override validation stays in one function.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017g1jRaFc7W5P4yLKXarLf9