feat: add bounded control plane rate limiting

server/api/service.go

@@ -71,6 +71,7 @@ type Service struct {
 	Proposals      map[string]*domain.Proposal
 	RankedProfiles map[string]domain.RankedProfile
 	TierPolicy     domain.TierPolicy
+	RateLimiter    *RateLimiter
 	proposalMu     sync.Mutex
 	eventsMu       sync.Mutex
 	events         *eventHub
@@ -96,7 +97,16 @@ func (s *Service) Handler() http.Handler {
 	mux.HandleFunc("/api/v1/proposals/", s.contractProposalMutation)
 	mux.HandleFunc("/api/v1/assignments/", s.contractAssignment)
 	mux.HandleFunc("/api/v1/events", s.controlPlaneEvent)
-	return mux
+	if s.RateLimiter == nil {
+		return mux
+	}
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if !s.RateLimiter.Allow(requestRateKey(r), s.now()) {
+			writeError(w, http.StatusTooManyRequests, "rate_limited")
+			return
+		}
+		mux.ServeHTTP(w, r)
+	})
 }
 
 type steamSessionRequest struct {