feat: add rate limiter utility

backend/tests/test_rate_limit.py

@@ -0,0 +1,16 @@
+from app.rate_limit import RateLimiter
+
+
+def test_allows_up_to_limit_then_blocks():
+    limiter = RateLimiter(max_requests=3, window_seconds=60)
+    assert limiter.allow("user-1") is True
+    assert limiter.allow("user-1") is True
+    assert limiter.allow("user-1") is True
+    assert limiter.allow("user-1") is False
+
+
+def test_different_keys_tracked_independently():
+    limiter = RateLimiter(max_requests=1, window_seconds=60)
+    assert limiter.allow("user-1") is True
+    assert limiter.allow("user-2") is True
+    assert limiter.allow("user-1") is False