Description

The API currently has no rate limiting, which could allow abuse. We should add basic rate limiting to protect the service.

Requirements

• Use express-rate-limit package
• Limit to 100 requests per 15 minutes per IP
• Return 429 Too Many Requests when limit exceeded
• Add custom error message explaining the limit

Example Response (when rate limited)

{
  "error": {
    "message": "Too many requests. Please try again in 15 minutes.",
    "status": 429
  }
}

Acceptance Criteria

• Rate limiting middleware is added
• Limit is configurable via environment variable
• Appropriate headers are returned (X-RateLimit-Limit, X-RateLimit-Remaining)