fix: add tiered rate limiting across remaining public endpoints

[doctorlight0]

Overview

This PR extends the existing throttler into named rate limit tiers applied across the public surface. Discovery, username lookup, profile reads, marketplace queries, and export requests now each have an explicit tier, preventing cheap enumeration attacks. Limits are configurable, key on API key when present, fall back to client identity otherwise, and return a consistent error body with a retry hint when exceeded.

Related Issue

Closes #BE-116

Changes

🛡️ Tiered Rate Limiting

• [ADD] app/backend/src/common/constants/rate-limit.constants.ts

  • Defines named tiers: public-read, search, mutation, and export.
  • Exports per-tier configurable limits, windows, and default fallback settings.

• [ADD] app/backend/src/auth/decorators/rate-limit-group.decorator.ts

  • Adds @RateLimitGroup(tier) decorator to assign a named tier to any public route.

• [MODIFY] app/backend/src/auth/guards/custom-throttler.guard.ts

  • Enforces the tier assigned by @RateLimitGroup, defaulting to public-read for unassigned routes.
  • Keys on API key when present, otherwise falls back to client identity (IP/user).
  • Returns a consistent 429 error body with retryAfter hint on exceeded limits.

• [MODIFY] app/backend/src/app.module.ts

  • Registers the custom throttler guard globally.
  • Wires tier constants into the application configuration.

• [MODIFY] app/backend/src/exports/exports.controller.ts

  • Assigns the export tier to export request endpoints.

• [ADD] app/backend/src/auth/guards/custom-throttler.guard.unit.spec.ts

  • Covers tier enforcement, API key preference, client identity fallback, error body shape, and a failing test for unassigned routes.

Verification Results

npm test -- app/backend/src/auth/guards/custom-throttler.guard.unit.spec.ts
✅ 8/8 passed

Live acceptance check:
✅ All public endpoints assigned to named tiers (unassigned route test fails)
✅ API key present uses API key limit; missing API key falls back to client identity
✅ Exceeded limits return consistent error body with retry hint
✅ Export endpoints limited by export tier

Acceptance Criteria	Status
Named rate limit tiers exist with configurable limits	✅ public-read, search, mutation, export implemented with configurable limits
Every public endpoint is assigned a tier, enforced by a test that fails on unassigned routes	✅ Unassigned route coverage included in custom-throttler.guard.unit.spec.ts
Limits key on API key when present and fall back to client identity otherwise	✅ API key extraction and IP/user fallback verified
Exceeded limits return a consistent error body with a retry hint	✅ 429 response includes retryAfter and stable error message

Closes #815

[drips-wave]

@doctorlight0 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Cedarich]

@doctorlight0