Read real provider rate limits from response headers before a launch

Instead of guessing OpenAI tiers before a traffic spike, make one tiny real request per model with the production key (loaded from the secrets manager into an env var, never echoed) and print only the x-ratelimit-limit-requests / x-ratelimit-limit-tokens headers. For moderation-style endpoints with complex payloads, import the app's own request builder so the call is valid. Pair it with CloudWatch metric pulls (RDS CPUUtilization, CPUCreditBalance, FreeableMemory; ECS CPU/Memory max over 6h) and SHOW max_connections vs pool size: in our case the providers had huge headroom while the real risks were our own 0.25 vCPU single container, a db.t4g.micro with ~100MB free memory, a 10-connection pool shared with telemetry writes, and zero alarms.