Issue18/add rate limiting

[happychuks]

This PR Adds API Rate Limiting Implementation

Summary

Implements comprehensive API rate limiting to prevent abuse and ensure fair usage. Uses sliding window algorithm with configurable limits per endpoint.

Acceptance Criteria Met

• Rate limiting works correctly - Sliding window algorithm with memory management
• Headers included - Complete rate limit headers in all responses
• Errors handled - 429 status codes with structured error responses
• Configuration flexible - Environment variables with enable/disable toggle

Key Features

• Smart client identification (proxy/load balancer aware)
• Endpoint-specific limits (100/hour global, 30/5min chat)
• Exempted endpoints (health checks, docs, static files)
• Memory efficient with automatic cleanup
• Thread-safe concurrent request handling

Files Changed

Required:

• app/api/v1/agents_router.py - Rate limit handlers + /rate-limits endpoint
• app/middleware/rate_limit.py - Core middleware implementation

Additional:

• app/config/settings.py - Configuration variables
• main.py - Middleware integration
• env.example - Environment variable examples
• tests/test_rate_limit.py - Comprehensive test suite
• scripts/test_rate_limiting.py - Manual testing script
• docs/rate-limiting.md - Complete documentation

Testing

• Unit tests for rate limit store and middleware
• Integration tests with FastAPI
• Manual testing script for live validation
• Performance and concurrency testing

Rate Limit Headers

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 99  
X-RateLimit-Reset: 1691751600
X-RateLimit-Window: 3600
Retry-After: 120 (when limited)

Configuration

RATE_LIMIT_ENABLED=true
RATE_LIMIT_REQUESTS=100      # Global: 100/hour
RATE_LIMIT_CHAT_REQUESTS=30  # Chat: 30/5min

Benefits

• Abuse Prevention - Protects against excessive usage
• Fair Access - Ensures equitable usage for all users
• System Stability - Prevents backend overload
• Cost Control - Reduces infrastructure abuse costs

Breaking Changes

None - Purely additive feature, no existing API changes.

Ready for Production

• No new dependencies added
• Comprehensive documentation included
• Memory-efficient implementation
• Flexible configuration options

How to test:

# Run the test script
python scripts/test_rate_limiting.py

# Check rate limit info
curl http://localhost:8000/api/v1/agents/rate-limits