feat(control-plane): add per-key rate limiting on hot endpoints

[7vignesh]

Summary

Fixes #429. Adds per-key token-bucket rate limiting to the control plane's hot endpoints (/execute, /discovery, /nodes/status/bulk), preventing a single misbehaving client from exhausting the async worker pool and database connections.

Type of change

• New feature
• Bug fix

Implementation

Middleware (middleware/ratelimit.go)

• RateLimiterStore — per-key golang.org/x/time/rate token-bucket limiters with a sync.Mutex-guarded map and background eviction of idle keys (10 min TTL)
• RateLimit gin middleware — extracts key from API key identity (set by auth middleware) or falls back to client IP; returns HTTP 429 with Retry-After header and JSON body on limit breach
• RateLimitConfig / RateLimitsConfig — per-endpoint configuration types with IsEnabled() and DefaultRateLimitConfig()

Config (config/config.go)

• Added RateLimitConfig to AgentFieldConfig — configurable via agentfield.yaml:

agentfield:
  rate_limit:
    enabled: true
    execute_rps: 50
    execute_burst: 100
    discovery_rps: 20
    discovery_burst: 40
    bulk_status_rps: 30
    bulk_status_burst: 60
    global_rps: 200
    global_burst: 400

Routes (routes_core.go, server.go)

• initRateLimiters() — creates per-endpoint stores from config at startup
• Applied to: /api/v1 (global), /execute group, /discovery group, /nodes/status/bulk
• Graceful shutdown: Stop() halts eviction goroutines
• Opt-in: disabled by default (rate_limit.enabled: false) to avoid breaking existing deployments

Defaults (when enabled)

Endpoint	RPS	Burst
Execute	50	100
Discovery	20	40
Bulk Status	30	60
Global (per-IP)	200	400

Test plan

• cd control-plane && go test ./internal/server/middleware/ -run TestRateLimit -v (9 tests)
• cd control-plane && go test ./internal/config/ -timeout 30s
• cd control-plane && go build ./...
• cd control-plane && go vet ./internal/server/... ./internal/config/...
• cd control-plane && golangci-lint run ./internal/server/middleware/ (no new warnings)

Test coverage

• I ran tests for the surface(s) I changed locally.
• New code paths are covered by tests in this PR (no bare additions).
• If I removed code, I updated coverage-baseline.json in this PR only if the removal caused a legitimate regression.
• The coverage gate check is green in CI before requesting review.

Checklist

• Commits follow conventional-commits style.
• I have linked any related issues (Fixes [Control Plane] No rate limiting on hot endpoints #429).

Related issues / PRs

Fixes #429

Notes

• TestGinLoggerEmitsStructuredDebugLine is a pre-existing flaky test unrelated to this change.
• golang.org/x/time was already an indirect dependency (v0.8.0 via otel); upgraded to v0.15.0.

[github-actions]

📊 Coverage gate

Thresholds from .coverage-gate.toml: per-surface ≥ 84%, aggregate ≥ 85%, max per-surface regression ≤ 1.0 pp, max aggregate regression ≤ 0.50 pp.

Surface	Current	Baseline	Δ
control-plane	87.20%	87.40%	↓ -0.20 pp	🟡
sdk-go	92.90%	92.00%	↑ +0.90 pp	🟢
sdk-python	94.20%	93.73%	↑ +0.47 pp	🟢
sdk-typescript	91.39%	90.42%	↑ +0.97 pp	🟢
web-ui	84.76%	84.79%	↓ -0.03 pp	🟡
aggregate	85.66%	85.75%	↓ -0.09 pp	🟡

✅ Gate passed

No surface regressed past the allowed threshold and the aggregate stayed above the floor.

[github-actions]

📐 Patch coverage gate

Threshold: 80% on lines this PR touches vs origin/main (from .coverage-gate.toml:thresholds.min_patch).

Surface	Touched lines	Patch coverage	Status
control-plane	197	90.00%	✅
sdk-go	0	—	➖ no changes
sdk-python	0	—	➖ no changes
sdk-typescript	0	—	➖ no changes
web-ui	0	—	➖ no changes

✅ Patch gate passed

Every surface whose lines were touched by this PR has patch coverage at or above the threshold.

[santoshkumarradha]

Checked the new rate-limit wiring locally. The endpoint-specific tests pass, the feature stays inert unless explicitly enabled, and the config surface is straightforward.