Issue #3615487: Add flood control to public write endpoints

All eleven write endpoints - six form and review submissions, five like and view counters - now pass through MyrestResourceBase::floodCheck(), which uses the core flood service and answers 429 with Retry-After when the client is over the limit. The event is per plugin ID and the identifier is the account for an authenticated caller, the client IP otherwise. A refused call is not registered, so a client over the limit cannot keep pushing its own window out.

Adds flood_limit and flood_window settings. Also fixes $this->ip, which was set only when an x-client-ip header was present and otherwise left at its 'N/A' default, so error logs recorded no real client address.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Closes #3615487