Per-test rate limiting / budget controls

## Problem
Some tests should not affect too much traffic at once (even if match expands unexpectedly).

## Proposal
Add per-test budgets:
- max packets per second handled by a test
- max concurrent flows tracked
- optional sampling percentage

## Alternatives considered
External rate limiting.

## Additional context
Helps keep impact controlled when rules change or traffic spikes.