feat: malware scan rate limiting & auto retry

[ansgarlichter]

Summary

• Handle SAP Malware Scanning Service rate limits (HTTP 429) with automatic retry using exponential backoff and jitter
• Limit concurrent scan requests per process via a semaphore to reduce pressure on the shared 30-request subaccount limit
• Refactor scanFile from raw https.request to axios for cleaner error handling and retry-after header support
• Skip redundant object store download for hash computation when malware scanning is enabled — the scanner already returns SHA-256

Motivation

The SAP Malware Scanning Service enforces a rate limit of 30 concurrent requests per subaccount. When multiple applications or pods share the same subaccount, bulk uploads can easily trigger 429 responses, causing scan failures and attachments stuck in "Scanning" status.

Additionally, when using remote storage backends (S3, Azure, GCP), each file upload triggered two downloads from the object store: once in put() for inline SHA-256 hash computation, and once in the scanner to send the file to the malware API. Since the scanner response already includes SHA-256, the first download is redundant.

Issues

Closes #401