[All Services] Add Rate Limiting Middleware

[ScriptedBro]

Migrated from DelegoLabs/Delego#443.
This issue belongs to the backend repository after the monorepo split.

---

Type
Task

Area
Backend / All Services

Complexity
Moderate

Problem
No service has rate limiting. Wallet, payments, orchestrator, and notification routes are all vulnerable to abuse and DDoS.

Implementation Scope

• apps/backend/gateway/middleware/rateLimiter.ts (new)
• Apply to all service routes

Functions to Implement

1. Create a sliding-window rate limiter using Redis.
2. Default: 100 requests per minute per IP.
3. Return 429 Too Many Requests with Retry-After header when exceeded.
4. Make limits configurable via env vars.

Tests

• Unit test: requests under limit pass through.
• Unit test: requests over limit return 429.
• Unit test: retry-after header is present.

Acceptance Criteria

• All service routes have rate limiting.
• Limits are configurable per service.
• 429 response includes retry-after.

Verification

• pnpm test passes.
• pnpm build completes.

[Chigybillionz]

Hello,

You can check out my previous work here:

GitHub: https://github.com/chigybillionz

I'd like to work on this issue. 💻

I understand the main concern here: without a shared rate-limiting layer, the wallet, payments, orchestrator, and notification services can each become an easy target for abuse or request floods.

I'll implement a Redis-backed sliding-window rate limiter with a configurable default of 100 requests per minute per IP, apply it consistently across the service routes, and return a proper "429 Too Many Requests" response with "Retry-After" when the limit is exceeded. I'll also keep the configuration flexible so limits can be adjusted per service without changing the middleware itself.

I'll add focused tests for requests below the limit, requests exceeding the limit, and the "Retry-After" behavior, then verify the complete implementation with "pnpm test" and "pnpm build". ⚡

I've worked with backend systems, API security, and distributed application flows, and I'd be glad to take this from the middleware implementation through testing and verification.

Feel free to review my GitHub profile to see the work I've been doing. Looking forward to shipping this. 🚀