fix(monitors): rate limit heartbeats per token and kind; test limiter key and fail body cap

web/e2e/heartbeat.spec.ts

@@ -26,7 +26,6 @@ test("heartbeat monitor: URL ping, /fail, header ping", async ({ page, request }
     let got = await (await page.request.get(`${BASE_URL}/api/monitors/${monitor.monitor_id}`)).json();
     expect(got.state.status).toBe("up");
 
-    await new Promise((r) => setTimeout(r, 1100)); // per-token limit is 1/s
     const fail = await request.post(`${BASE_URL}/public/hb/${monitor.heartbeat_token}/fail`, { data: "disk full" });
     expect(fail.status()).toBe(200);