[rennf93]

Closes #140

Ports Guard-Core/guard-core#169 to the Rust engine. DynamicRuleManager::apply_rule now restores the retained base snapshot before applying, so each version (or a different rule id) is an overlay on the base config and not on the previous version. Expiry is unchanged. Emergency mode no longer compounds: base 16 gives 8, 8, 8 across versions 1 to 3, and expiry restores 16.

Other divergences fixed in the same area: country rules are skipped when neither geo_ip_handler nor a non-empty ipinfo_token can resolve a country, a zero global_rate_limit or global_rate_window is ignored (falsy in the reference), a zero auto_ban_threshold or auto_ban_duration rejects the whole delivery and the last-known snapshot (ge=1 in the reference), and hydrate_last_known_rules only runs with enable_dynamic_rules and persists the snapshot like _apply_rules does. The existing tests that applied countries or hydrated now set ipinfo_token and enable_dynamic_rules.

I ported the eight reference tests with the same scenarios and values. On master five of them fail (halving gives 8, 4, 2; a version keeps the previous version's change; a different rule id inherits it; expiry restores 4 instead of 16; a version after hydration compounds to 4). The collection test and the pattern test pass on both sides, because the engine replaces collections per version and SusPatternsManager::add_pattern already deduplicates. The failed-apply scenario has no reachable failure here (apply_to_config is infallible), so that test only pins that a poisoned config lock leaves the active version and base untouched, and it also passes on master.