Closes BOTH task NousResearch#265 (slowapi misplacement) AND task NousResearch#269
(test_web_server_mcp_clients failures — same root cause, traced
in PR #125's Part B investigation).

Problem
=======

`kora_cli/listeners/webhooks.py` imports `slowapi` unconditionally
for the public webhook rate-limiter. The import chain

  kora_cli/web_server.py
    → kora_cli/listeners/__init__
    → kora_cli/listeners/webhooks
    → slowapi

runs on any process that touches web_server. With slowapi sitting
under the `[web]` optional-deps extra, base-install environments
(CI / fresh dev / `uv sync --extra dev` only) hit
ModuleNotFoundError at import time — collapsing 13 mcp_clients
tests (failures) + 5 more (collection errors) on a single missing
package, NOT on stale assertions.

Fix
===

  * pyproject.toml: remove `slowapi>=0.1.9` from
    [project.optional-dependencies].web
  * pyproject.toml: add `slowapi==0.1.9` to [project].dependencies,
    next to the aiosmtplib pin that established this discipline in
    PR #124. Inline comment cites task NousResearch#265 + PR #125 so the next
    contributor inheriting this code sees the rationale.
  * Version pin is exact-equals (==0.1.9) per the security policy
    in the dependencies block header (2026-05-12 Mini Shai-Hulud
    response). Resolved via `uv pip compile` against the existing
    constraint graph — same version slowapi was already shipping.
  * uv.lock regenerated via `uv lock`. slowapi promoted from
    extras-only into the root dep set; limits transitive (5.8.0)
    pulled in alongside (slowapi's only required runtime dep).

Verification
============

Base-install path (`uv sync --frozen --extra dev`, NO --extra web):

  * tests/kora_cli/test_web_server_mcp_clients.py: 19/19 pass
    (was 13 fail + 5 err; matches what PR #125's investigation
    predicted when --extra web was installed)
  * Full admin-panel regression: 271/271 across 23 suites
  * No regression elsewhere

Refs
====

  * Task NousResearch#265 — slowapi misplacement (closed by this PR)
  * Task NousResearch#269 — test_web_server_mcp_clients failures (closed:
    same root cause as NousResearch#265 per PR #125 investigation)
  * PR #124 — aiosmtplib runtime-promotion (same discipline)
  * PR #125 — KR-FRONTEND-CLEANUP Part B (root-cause investigation)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>