improve: enhance in-memory rate limiter with headers and safety

[Shreya-nipunge]

Description

This PR improves the existing in-memory rate limiter by adding production-grade API enhancements such as standard rate-limit headers, memory safety improvements, and better documentation while keeping the lightweight architecture unchanged.

The goal is to enhance usability and robustness without introducing external dependencies or increasing system complexity.

---

Related Issue

Fixes #682

---

Changes Made

• Added standard rate-limit response headers:

  • X-RateLimit-Limit
  • X-RateLimit-Remaining
  • X-RateLimit-Reset

• Added memory safety improvements:

  • Maximum entry cap to prevent uncontrolled memory growth
  • Eviction logic for oldest entries when limit is exceeded
  • Periodic cleanup of stale entries

• Improved inline documentation explaining design trade-offs (in-memory vs distributed systems)

• Ensured compatibility for both authenticated (req.user.id) and unauthenticated (req.ip) requests

• Clarified that in-memory reset behavior on server restart is an intentional design trade-off

---

Design Decision

This rate limiter is intentionally implemented using an in-memory Map to ensure high performance and zero external infrastructure dependency. This approach keeps latency minimal and simplifies local development and deployment.

The limitation of state reset on server restart and per-instance behavior is acknowledged as an accepted trade-off for this design.

---

Impact

• Improves API usability with standard HTTP rate-limit headers
• Enhances memory safety for long-running server processes
• Maintains low latency for AI/chat-related routes
• Preserves existing behavior with no breaking changes

---

Testing

• Verified rate limiting triggers correctly at 20 requests/minute
• Confirmed rate-limit headers are returned properly
• Tested memory behavior under repeated requests
• Ensured no regression in existing routes using middleware

[vercel]

@Shreya-nipunge is attempting to deploy a commit to the durdana3105's projects Team on Vercel.

A member of the Team first needs to authorize it.

[durdana3105]

this branch have merge conflicts please resolve it

[Shreya-nipunge]

Hi @durdana3105 ,

The merge conflicts have been resolved and the branch is now up to date with the latest upstream changes.

The current CI failure appears to occur during npm ci due to a Vite / @vitejs/plugin-react-swc peer dependency conflict and does not seem related to the rate limiter changes in this PR.

Thank you.