feat(limiter/traffic): add burst support, dropped-packet counters, and cache fixes

- Add NewLimiterWithBurst(rate, burst) for independent burst control
- Extend parseLimit to accept optional 4th field as burst size
- Add DroppedPacketCounter interface with DroppedPackets() for packet/udp conns
- Export ErrRateLimited sentinel for rate-limit error checks
- Fix IP-level cache expiration (NoExpiration → defaultExpiration) to prevent
  unbounded growth; reset TTL on access in In/Out
- Short-circuit single-limiter path to avoid limiterGroup allocation
- Add nil guard in cachedTrafficLimiter when both old and new values are nil
- Remove unused ctx field from wrapper structs

limiter/traffic/cache/limiter.go

@@ -115,6 +115,9 @@ func (p *cachedTrafficLimiter) In(ctx context.Context, key string, opts ...limit
 
 	limNew := p.limiter.In(ctx, key, opts...)
 	if limNew == nil {
+		if lim == nil {
+			return nil
+		}
 		limNew = lim
 	}
 	if item == nil || !p.equal(lim, limNew) {
@@ -149,6 +152,9 @@ func (p *cachedTrafficLimiter) Out(ctx context.Context, key string, opts ...limi
 
 	limNew := p.limiter.Out(ctx, key, opts...)
 	if limNew == nil {
+		if lim == nil {
+			return nil
+		}
 		limNew = lim
 	}
 	if item == nil || !p.equal(lim, limNew) {