Encapsulate domain properly: Limit, Counter & CheckResult

[alexsnaps]

We should narrow the surface of the API. Across the entire crate, but probably at the domain layer the most.
It currently leaks a little all over the place and isn't well encapsulated, e.g. Counter et al being unclear API boundaries and used as domain model, DTOs & configuration.