feat(limiter/traffic): add burst support, dropped-packet counters, and cache fixes

- Add NewLimiterWithBurst(rate, burst) for independent burst control
- Extend parseLimit to accept optional 4th field as burst size
- Add DroppedPacketCounter interface with DroppedPackets() for packet/udp conns
- Export ErrRateLimited sentinel for rate-limit error checks
- Fix IP-level cache expiration (NoExpiration → defaultExpiration) to prevent
  unbounded growth; reset TTL on access in In/Out
- Short-circuit single-limiter path to avoid limiterGroup allocation
- Add nil guard in cachedTrafficLimiter when both old and new values are nil
- Remove unused ctx field from wrapper structs

limiter/traffic/limiter.go

@@ -15,13 +15,24 @@ type llimiter struct {
 }
 
 // NewLimiter creates a rate-based traffic Limiter with the given rate
-// (bytes per second) and burst size.
+// (bytes per second). The burst size is set equal to the rate.
 func NewLimiter(r int) limiter.Limiter {
 	return &llimiter{
 		limiter: rate.NewLimiter(rate.Limit(r), r),
 	}
 }
 
+// NewLimiterWithBurst creates a rate-based traffic Limiter with the given rate
+// (bytes per second) and burst size. If burst <= 0, it defaults to r.
+func NewLimiterWithBurst(r, burst int) limiter.Limiter {
+	if burst <= 0 {
+		burst = r
+	}
+	return &llimiter{
+		limiter: rate.NewLimiter(rate.Limit(r), burst),
+	}
+}
+
 func (l *llimiter) Wait(ctx context.Context, n int) int {
 	if l.limiter.Burst() < n {
 		n = l.limiter.Burst()