feat: Add rate limiting to public API routes

[Aj-Kayvee]

Summary

Integrates with Upstash Redis to rate-limit public-facing API routes before they reach the database layer.

Changes

• **** — New module wrapping with a sliding window of 100 requests per IP per 60 seconds. Uses so configuration is driven entirely by and .
• **** — Public API routes (, , ) are now rate-limited. When the limit is exceeded the middleware returns a 429 Too Many Requests with standard headers:
  • — seconds until the window resets
  • — configured limit (100)
  • — 0 when blocked
  • — Unix timestamp (ms) when the window resets
• Client IP is extracted from (first entry) or , falling back to .

Design decisions

• Middleware-level enforcement — rate limiting runs before any DB query or business logic, so abusive traffic is rejected at the edge.
• Sliding window algorithm — provides smooth limiting without the burst issues of fixed windows.
• Graceful degradation — if or are not set, throws; operators must provide both env vars. This is intentional: a deployment without rate limiting should fail closed rather than silently allow unlimited traffic.
• Private routes untouched — dashboard and private API routes already require session auth (JWT) and are not rate-limited by this change.

Required environment variables

Variable	Description
UPSTASH_REDIS_REST_URL	Upstash Redis REST URL
UPSTASH_REDIS_REST_TOKEN	Upstash Redis REST token

Acceptance criteria

• Exceeding the limit returns a 429 response
• Legitimate traffic is not unnecessarily blocked (100 req/min/IP is generous for normal use)
• Middleware handles rate limiting efficiently before hitting the DB

Closes #131

[drips-wave]

@Aj-Kayvee Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@Aj-Kayvee is attempting to deploy a commit to the ACCENSA Team on Vercel.

A member of the Team first needs to authorize it.

[mergekeeper]

MergeKeeper review

Scope: in scope for linked issue #131.
Verdict: clean

Rate limiting has been successfully added to public API routes using Upstash Redis in the Next.js middleware with correct 429 response handling and headers.

Reviewed commit: 483af179ce6cf56999b66c58311c9c6aedf7b071.
CI and merge eligibility are checked separately.

[mergekeeper]

MergeKeeper merge status

Status: blocked
PR state: open
Mergeability: mergeable
Checked commit: 483af179ce6cf56999b66c58311c9c6aedf7b071.

Reason: One or more required CI checks failed.

Failing checks:

• format - view details
• test (web) - view details

Next steps:

1. Open the failing check details above and fix the reported error.
2. Run the same checks locally where possible.
3. Commit and push the fix.
4. MergeKeeper will automatically re-review the updated PR.