chore: raise API rate limit for shared-IP offices (300→3500/min)

[piyalbasu]

Summary

• Raise the global @fastify/rate-limit cap from 300 → 3500 req/min (src/route/index.ts:125)
• Raise the per-route /onramp/token cap from 20 → 100 req/min (src/route/index.ts:1485)

Rationale

The limiter is keyed by IP. That's fine for residential users, but breaks down for any office NAT'd behind a single egress address — every coworker shares one bucket.

We have a ~170-person office in that situation. At 300 req/min that's <2 req/user/min before the bucket is exhausted, which an active wallet session blows through immediately (balance fetch + price poll + tx simulation is easily 5-10 req/min per active user). The result is real users getting 429s the moment a handful of them open Freighter at the same time.

Sizing the new ceiling:

• 3500/min global → ~20 req/user/min if all 170 are simultaneously active. Comfortable headroom for bursty refreshes (e.g. Monday-morning wallet opens) while still catching a truly runaway client.
• 100/min for /onramp/token → onramp initiation is rare per-user (you start one fiat purchase, not many), but 20/min across 170 people is one initiation every 8.5s, which is too tight for a shared IP. 100/min is still well under what a single abusive client could plausibly need.

Trade-offs

• Still per-IP, so this only helps shared-egress cases; it does not change protection against per-client abuse — the new ceiling is still much lower than any reasonable abuse pattern.
• If we want to stop relying on IP as the key entirely (e.g. key by IP + pubkey, or per-session), that's a keyGenerator change, deferred to a follow-up.

Test plan

• CI green
• After deploy, watch 429 rate in Grafana — expect a drop from the affected office's egress IP
• Spot-check that abusive synthetic load against a single client still gets limited (3500/min is still well under what a real attacker would emit)

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR raises API rate limits to better support many users sharing a single NAT egress IP, reducing accidental 429s for shared-IP office environments.

Changes:

• Increases the global API rate limit from 300 to 3500 requests/minute.
• Increases /onramp/token route-specific rate limit from 20 to 100 requests/minute.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.