fix(health): return 429 for rate-limited probes and tighten bind example

[oxarbitrage]

Converted from empty PR #10578 (Copilot SWE Agent created a plan but never implemented it).

Motivation

The health endpoint docs show a public bind example that contradicts the page's own security guidance, and the health server drops over-limit probe connections without an HTTP response. The default example should be safer and rate limiting should be explicit to clients and operators.

Suggested Solution

• Docs

  • Update the health config example to bind to localhost by default instead of 0.0.0.0.
  • Add a short note that Kubernetes deployments may need a pod-local or otherwise restricted address.
  • Tighten the security wording so the example and guidance are aligned.

• Health server rate limiting

  • Change the over-limit path from silently dropping the accepted socket to returning 429 Too Many Requests.
  • Include Retry-After so probe clients and operators get a concrete backoff signal.

• Counter reset cleanup

  • Make the recent-request interval reset easier to follow by resetting on elapsed interval boundaries instead of only on the first over-limit request after the window expires.

Example response on the rate-limit path:

HTTP/1.1 429 Too Many Requests
Retry-After: 60
Content-Type: text/plain; charset=utf-8

too many health requests, retry later

Relevant files

• book/src/user/health.md
• zebrad/src/components/health.rs