feat:Backend: Apply per-principal rate limiting

[Ivenkili]

Summary

Implement per-principal rate limiting across the backend to ensure authenticated clients are isolated from one another and expensive endpoints receive appropriately stricter limits.

Currently, rate limits are not consistently scoped to the authenticated principal, allowing one authenticated client to consume a shared budget associated with the source address. This change introduces principal-aware keys while preserving source-address fallback for unauthenticated requests.

Changes Made

• Updated rate-limit key generation to use the authenticated principal when available.

• Added source-address fallback for requests without an authenticated principal.

• Added separate, stricter rate limits for expensive endpoint classes:

  • Search
  • Export
  • Analytics
  • Contract simulation

• Added standard rate-limit response headers.

• Added Retry-After headers for rejected requests.

• Added separately configurable rate limits for bot and service principals authenticated through bot-auth.

• Added rate-limit rejection metrics labelled by endpoint class.

• Added tests covering principal isolation, endpoint-specific limits, headers, bot/service limits, and rejection metrics.

Acceptance Criteria

• Limits are keyed by authenticated principal when one exists.
• Unauthenticated requests fall back to the source address.
• Search, export, analytics, and contract simulation have stricter limits.
• Responses include standard rate-limit headers.
• Rejected requests include a Retry-After value.
• Bot and service principals have separately configurable limits.
• Rate-limit rejections are exported as metrics labelled by endpoint class.

Testing

• Test that authenticated principals receive independent rate-limit budgets.
• Test that unauthenticated requests are limited by source address.
• Test stricter limits for expensive endpoints.
• Test rate-limit headers on successful and rejected requests.
• Test Retry-After on rate-limit rejection.
• Test separate limits for bot and service principals.
• Test rejection metrics contain the correct endpoint-class label.
• Run the existing backend test suite and local validation.

Files / Areas

• apps/backend/src/common/rate-limit/
• Relevant backend endpoint and metrics modules.

Closes #1205

[drips-wave]

@Ivenkili Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

Kindly fix CI