🐛(backend) refactor lobby throttling to use participant id instead of IP

use the lobby participant cookie ID as the throttle cache key
rather than the client IP address.

This avoids penalising multiple users behind the same NAT or proxy
and aligns throttling with how LobbyService identifies participants.

This bug was spotted in production where users from ministries behind
NAT was blocked by throttling while using visio.

If no cookie is present yet, skip throttling for the request. The
cookie will be set on the first response and throttling will apply
from subsequent requests.

This throttle is intended to protect against accidental hammering
from buggy clients, not as a security control against DoS attacks.

This is not a security measure, we should use a WAF.

CHANGELOG.md

@@ -26,6 +26,7 @@ and this project adheres to
 
 - 🐛(frontend) fix hand icon and queue position alignment and position #1119
 - 🩹(backend) add page_size to pagination for room endpoints #1131
+- 🐛(backend) refactor lobby throttling using participant id instead of IP #1129
 
 ## [1.10.0] - 2026-03-05