[therealmercy-dev]

Summary

• Enforce independent sliding-window OTP request limits per identifier and client IP, returning 429 with Retry-After when either budget is exceeded.
• Make the request threshold and window configurable with OTP_RATE_LIMIT_MAX_REQUESTS and OTP_RATE_LIMIT_WINDOW_MINUTES.
• Apply the limiter to both /request-otp and recovery phone changes before account mutation or SMS delivery.
• Add IP persistence and indexes through migration 016_otp_rate_limit_ip.sql, including support for email-length identifiers.
• Add tests for identifier and IP throttling, plus coverage that recovery OTP requests invoke the limiter.

Validation

• TypeScript diagnostics and git diff --check passed.

Closes #484

[drips-wave]

@therealmercy-dev Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits