Fix WebSocket rate limiter ignoring per-project Redis key prefix

[AlexGaillard]

What's Changed

• The WebSocket rate limiter forced its Redis keys to always start with websocket. On shared-Redis setups where each project can only touch keys starting with its own name, this blocked the project from reading its own limiter keys, so WebSocket rate limiting broke.
• Gave the WebSocket limiter its own settings group (RATE_LIMITER_WEBSOCKETS_*), matching how the other limiters already work.
• The key prefix now defaults to websocket (so nothing changes for existing setups) and can be overridden per project with RATE_LIMITER_WEBSOCKETS_KEY_PREFIX.

Tested Scenarios

• Existing WebSocket controller tests pass (api base.test.ts).
• Env package tests pass, confirming the new defaults load correctly.

Review Notes / Questions / Concerns

• Enable/disable still follows the existing RATE_LIMITER_ENABLED flag, so turning rate limiting on/off is unchanged.
• Default limits (50 points / 1s) match the previous values, so behavior is the same unless the new variables are set.

Checklist

Leave unchecked where not applicable

• Tests added/updated
• Documentation PR created in directus/docs
• OpenAPI updated
  • Local specs package (@directus/specs)
  • PR created in directus/openapi
• SDK (@directus/sdk) updated to reflect the changes
• Types (@directus/types) updated to reflect the changes
• GraphQL schema updated to reflect the changes
• System data (@directus/system-data) updated for changes to system collections/fields/relations
• Database migration added for schema/system changes
• Environment variables documented for new/changed config
• App translations added for new user-facing strings
• Security implications apply

---

Fixes CMS-2985

[linear-code]

CMS-2985