Docs: remaining stale statements about rate limiting and the WAF #1774

What: after #1767 a few statements are stale or unverified: docs/cerberus.md roadmap row 1 (WAF placeholder + metrics) and row 5 (CrowdSec Planned), the Prometheus section (metrics are counted only in the management-API middleware), docs/api.md ~line 1446 ("when rate limiting is implemented"), the Burst row in the rate-limiting table (describes the management limit, not the proxy), and rule set files that contain their own SecRuleEngine line keep it regardless of the rule set mode. The 429 response and where detection hits are logged are unverified.
Severity: low.
Suggestion: verify against the code and correct.