feat(limiter/traffic): add burst support, dropped-packet counters, and cache fixes

- Add NewLimiterWithBurst(rate, burst) for independent burst control
- Extend parseLimit to accept optional 4th field as burst size
- Add DroppedPacketCounter interface with DroppedPackets() for packet/udp conns
- Export ErrRateLimited sentinel for rate-limit error checks
- Fix IP-level cache expiration (NoExpiration → defaultExpiration) to prevent
  unbounded growth; reset TTL on access in In/Out
- Short-circuit single-limiter path to avoid limiterGroup allocation
- Add nil guard in cachedTrafficLimiter when both old and new values are nil
- Remove unused ctx field from wrapper structs

limiter/traffic/traffic_test.go

@@ -110,7 +110,10 @@ func TestParseLimit(t *testing.T) {
 		{"key invalid_bytes", "key", 0, 0},
 	}
 	for _, tt := range tests {
-		key, in, out := l.parseLimit(tt.input)
+		key, in, out, burst := l.parseLimit(tt.input)
+		if burst != 0 {
+			t.Errorf("parseLimit(%q) unexpected burst: %d", tt.input, burst)
+		}
 		if key != tt.key || in != tt.in || out != tt.out {
 			t.Errorf("parseLimit(%q) = (%q, %d, %d), want (%q, %d, %d)",
 				tt.input, key, in, out, tt.key, tt.in, tt.out)