adjust rate limiter config

[wojcik91]

• reduce rate-limiter scope to just API routes
• make the defaults more permissive

Continued from #282

[Copilot]

Pull request overview

Adjusts the HTTP rate limiter configuration by scoping the governor middleware to API routes only and increasing the default rate limit values to be more permissive.

Changes:

• Refactors the Axum router so the governor rate limiter is applied only to /api/v1/* routes.
• Increases default rate limiting parameters (per-second and burst) in runtime config and the example TOML.
• Removes the previous “global” governor layer from the entire application router.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
src/http.rs	Builds a dedicated API router and applies GovernorLayer only to API routes, then merges into the main router.
src/config.rs	Updates default rate-limit values and corresponding CLI/env defaults.
example-config.toml	Updates sample config to reflect the new, more permissive rate-limit defaults.

Comments suppressed due to low confidence (1)

src/http.rs:530

• With the rate limiter now layered inside api_router, it runs after the global ensure_configured middleware. That means requests short-circuited by ensure_configured (e.g. returning 503 before the cookie key is set) will no longer be rate-limited, and /api/v1/* requests also incur the outer middleware stack before being rejected with 429. If the intent is to keep the limiter effective during the unconfigured phase (and to shed load earlier), consider making the governor layer outer to ensure_configured while still conditionally applying it only to /api/* (e.g., via a small conditional middleware/layer that only invokes governor for API paths).

        .merge(api_router)
        .fallback_service(get(handle_404))
        .layer(middleware::from_fn_with_state(
            shared_state.clone(),
            ensure_configured,
        ))

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.