feat: patterns/ directory + skill-impact tracker (WikiSkill-inspired)

- New patterns/ directory with 7 initial failure-mode patterns (PAT-001..007)
- skill-impact.md audit trail for skill modifications
- _template.md for future pattern creation
- index.md updated with Patterns section
- log.md entry for this change
- Inspired by arXiv:2608.27454 (WikiSkill)

patterns/1password-rate-limit.md

@@ -0,0 +1,51 @@
+---
+pattern_id: PAT-003
+title: "1Password CLI rate-limit is account-level — stop ESO, wait 1 hour"
+category: tooling
+severity: high
+status: active
+first_observed: 2026-07
+last_updated: 2026-08-30
+related_systems: [rke2-kubernetes]
+related_solution_docs:
+  - docs/solutions/architecture/2026-07-24-1password-account-level-rate-limit.md
+  - docs/solutions/bug-fixes/2026-07-14-1password-token-telegram-corruption.md
+related_skills: [1password-cli]
+---
+
+# 1Password CLI rate-limit is account-level — stop ESO, wait 1 hour
+
+## Symptom
+
+All 1Password CLI (`op`) calls suddenly fail with rate-limit errors. This affects
+both Hermes tools and ExternalSecrets Operator (ESO) in K8s simultaneously.
+The outage lasts approximately 1 hour.
+
+## Root Cause
+
+The 1Password CLI enforces rate limits at the **account level**, not per-token or
+per-client. When ESO polls aggressively (multiple SecretStores + frequent sync intervals),
+it exhausts the quota for the ENTIRE account, blocking all other `op` callers including
+Hermes automation.
+
+## Mitigation
+
+1. **Stop ESO immediately** — scale down the ESO deployment to halt API calls:
+   ```bash
+   kubectl scale deploy -n external-secrets external-secrets-operator --replicas=0
+   ```
+2. **Wait 1 hour** — the rate limit resets automatically. No polling needed.
+3. **Resume ESO** with reduced polling frequency afterward
+
+## Prevention
+
+- Reduce ESO `refreshInterval` to 10+ minutes (not the default 1 minute)
+- Limit the number of SecretStores that reference 1Password
+- Consider caching secrets locally to reduce API pressure
+- Never run `op` in tight loops — always add delays for batch operations
+
+## Evidence
+
+- Hit twice: Jul 2026 (initial discovery) and during token corruption investigation
+- Solution doc: `docs/solutions/architecture/2026-07-24-1password-account-level-rate-limit.md`
+- MEMORY.md entry: "1P CLI:3 vaults R/W. Rate-limit=acct-level. Stop ESO, wait 1hr, no polling."