[SECURITY] Implement Rate Limiting

[JoshuaAFerguson]

Objective

Add rate limiting to prevent abuse and DDoS attacks.

Rate Limits

// Per-user authenticated endpoints
- API requests: 1000 req/min
- Session creation: 10 req/min
- File uploads: 5 req/min

// Per-IP unauthenticated endpoints
- Login attempts: 5 req/min
- Registration: 3 req/hour

Implementation

Use Redis for distributed rate limiting across API replicas.

import "golang.org/x/time/rate"

// Middleware
func RateLimitMiddleware() gin.HandlerFunc {
    limiters := make(map[string]*rate.Limiter)
    // ...
}

Acceptance Criteria

• Rate limiting active on all endpoints
• 429 Too Many Requests returned
• Redis-based for multi-pod support
• Configurable limits
• Monitoring/alerting added

Files

• api/internal/middleware/ratelimit.go (NEW)