fix: #114 #123 #132 + circuit breaker stats — 4 HIGH from dual-audit v2.0.88-90

- client.js: cascadeHistoryBudget default 200k→400k, add truncation note
  for trimmed history so model doesn't ask user to repeat
- handlers/chat.js: add IP-rate-limit circuit breaker for non-stream and
  stream paths, record policy blocked + rate limited events
- handlers/messages.js: defensive startMessage() in finish() prevents
  event ordering violation when message stops before it starts
- dashboard/stats.js: track policyBlockedCount and rateLimitedCount,
  persist to stats.json for dashboard visibility