Implement API Rate Limiting & Throttling

[shamoo53]

PR Description — Implement API Rate Limiting & Throttling

Summary

This PR implements comprehensive API rate limiting and throttling to protect the service from abuse, improve resource allocation, and maintain system stability under high traffic. The implementation supports tier-based, endpoint-based, and IP-based limits with Redis-backed distributed state management.

Changes

• Added NestJS rate-limiting guard/middleware.

• Implemented sliding-window rate limiting.

• Added Redis-backed rate-limit state management for distributed environments.

• Added tier-based quotas:

  • Free: 100 requests/minute
  • Premium: 1,000 requests/minute
  • Enterprise: Unlimited

• Added configurable per-endpoint rate limits.

• Added IP-based throttling for unauthenticated requests.

• Added X-RateLimit-* response headers for rate-limit visibility.

• Added 429 Too Many Requests responses with Retry-After headers when limits are exceeded.

• Added configurable admin controls for runtime rate-limit adjustments.

• Added bypass support for critical system operations.

• Added graceful handling of rate-limit failures and high-load scenarios.

Testing

• Added unit tests covering rate-limit enforcement and sliding-window edge cases.
• Added Redis integration tests for distributed rate limiting.
• Added E2E tests simulating concurrent requests from multiple users and tiers.
• Verified rate-limit headers and 429 responses.
• Verified configurable quotas and admin adjustments.
• Validated that rate-limit checks add less than 10ms of latency under expected conditions.
• Maintained greater than 80% unit-test coverage for the rate-limiting implementation.

Closes #28