feat(limiter/traffic): add burst support, dropped-packet counters, and cache fixes

- Add NewLimiterWithBurst(rate, burst) for independent burst control
- Extend parseLimit to accept optional 4th field as burst size
- Add DroppedPacketCounter interface with DroppedPackets() for packet/udp conns
- Export ErrRateLimited sentinel for rate-limit error checks
- Fix IP-level cache expiration (NoExpiration → defaultExpiration) to prevent
  unbounded growth; reset TTL on access in In/Out
- Short-circuit single-limiter path to avoid limiterGroup allocation
- Add nil guard in cachedTrafficLimiter when both old and new values are nil
- Remove unused ctx field from wrapper structs

limiter/traffic/generator.go

@@ -5,14 +5,16 @@ import (
 )
 
 type limitGenerator struct {
-	in  int
-	out int
+	in    int
+	out   int
+	burst int
 }
 
-func newLimitGenerator(in, out int) *limitGenerator {
+func newLimitGenerator(in, out, burst int) *limitGenerator {
 	return &limitGenerator{
-		in:  in,
-		out: out,
+		in:    in,
+		out:   out,
+		burst: burst,
 	}
 }
 
@@ -20,6 +22,9 @@ func (p *limitGenerator) In() limiter.Limiter {
 	if p == nil || p.in <= 0 {
 		return nil
 	}
+	if p.burst > 0 {
+		return NewLimiterWithBurst(p.in, p.burst)
+	}
 	return NewLimiter(p.in)
 }
 
@@ -27,5 +32,8 @@ func (p *limitGenerator) Out() limiter.Limiter {
 	if p == nil || p.out <= 0 {
 		return nil
 	}
+	if p.burst > 0 {
+		return NewLimiterWithBurst(p.out, p.burst)
+	}
 	return NewLimiter(p.out)
 }