Rate limiting only covers `POST /payments`; other endpoints are unthrottled

[Darkdruce]

Summary

The limiter short-circuits unless the request is exactly POST /payments, leaving POST /merchants, all GET endpoints, and redelivery unprotected.

Location

• src/api/mod.rs:168 (if req.method() == POST && path == "/payments")

Details & impact

Merchant provisioning, payment enumeration, webhook listing, and redelivery can all be flooded, enabling DoS and abuse (see the provisioning and redelivery issues).

Suggested fix

Apply a baseline limiter to all routes with per-route overrides for expensive/sensitive ones.

Acceptance criteria

• All routes have a default limit; sensitive routes have stricter limits.

[Chongai-Cli]

Hello, can i be assigned to this issue?

[Me7858]

I would like to take ownership of this issue. My experience includes building scalable systems, improving developer tooling, and implementing secure backend services with comprehensive test coverage.

[grantfox-oss]

🦊 GrantFox — @Me7858 has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #72)
2. Your PR will be reviewed by the StellarGateLabs maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Official Campaign | FWC26 campaign!

@Me7858's PR #202 was approved and merged by @Manuel1234477.

🏆 @Me7858: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (188 total points). Track your full progress on GrantFox.

👏 Great work, @Me7858! Keep contributing to StellarGateLabs.