actualbudget: dedicated traefik rate-limit (50/300) for budget ingresses

The Actual web app boots with ~70 near-parallel requests (55
/data/migrations/*.sql + statics, all served cache-control max-age=0 so
every page load re-validates them). The shared rate-limit middleware
(average 10, burst 50) 429s the tail of that storm, so every cold boot
shows 'Server returned an error while checking its status' and every
load stalls in retry backoff — measured up to 5min stalls when two
loads from one IP overlap. Viktor asked to relax the limit after the
anca slow-load investigation (beads code-7zv).

Same pattern as immich: dedicated actualbudget-rate-limit middleware in
the traefik stack, budget-* ingresses opt out of the default via
skip_default_rate_limit + extra_middlewares.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

stacks/actualbudget/factory/main.tf

@@ -183,6 +183,11 @@ module "ingress" {
   tls_secret_name   = var.tls_secret_name
   dns_type          = "proxied"
   extra_annotations = var.homepage_annotations
+  # Actual's app boot fires ~70 parallel asset/migration revalidations
+  # (max-age=0); the default 10/50 limiter 429s the tail and stalls every
+  # load. Dedicated higher-burst limiter, same pattern as Immich.
+  skip_default_rate_limit = true
+  extra_middlewares       = ["traefik-actualbudget-rate-limit@kubernetescrd"]
 }