fix(api): add tiered rate limiting to prevent polling lockouts (#460)

* fix(api): add tiered rate limiting to prevent polling lockouts

Replace the single global rate limiter (100 req/min/IP) with a tiered
system that separates high-frequency polling endpoints from standard
API traffic:

- Polling tier (300/min): /stats, /system/stats, /stacks/statuses,
  /metrics/historical, /health, /meta, /auth/status, /auth/sso/providers,
  /license. Exempt from the global limiter but governed by their own
  safety net to prevent resource exhaustion.
- Standard tier (200/min): All other endpoints, raised from 100.
- Webhook tier (500/min): POST /webhooks/:id/trigger, dedicated limiter
  for CI/CD platforms sharing datacenter IPs.
- Auth tier: Unchanged (5-10 attempts / 15 min).

Enterprise adaptations:
- Authenticated requests keyed by user session (JWT sub/username) instead
  of IP, preventing shared NAT/VPN environments from pooling budgets.
- Internal node-to-node traffic (node_proxy tokens) bypasses all rate
  limiters entirely.

Includes comprehensive stress tests (21 cases) validating tier
separation, node proxy bypass, and per-user keying.

* chore(deps): bump axios to 1.15.0 to fix SSRF vulnerability

Addresses GHSA-3p68-rc4w-qgx5 (NO_PROXY hostname normalization bypass).

.env.example

@@ -19,8 +19,15 @@ NODE_ENV=production
 # Frontend URL for CORS in production (leave empty for same-origin setups)
 FRONTEND_URL=
 
-# Global API rate limit (requests per minute per IP, production only)
-API_RATE_LIMIT=100
+# Global API rate limit (requests per minute per user session, production only)
+# Authenticated requests are keyed by user ID; unauthenticated by IP.
+# Internal node-to-node traffic (node_proxy tokens) bypasses this limit entirely.
+API_RATE_LIMIT=200
+
+# Polling endpoint rate limit (requests per minute, production only)
+# Applies to dashboard/status polling endpoints that are exempt from the global limit.
+# Increase for environments with many concurrent browser sessions behind shared NAT.
+API_POLLING_RATE_LIMIT=300
 
 # ─── SSO / LDAP Configuration (Admiral) ───────────────────────────