fix: apply rate limiting to all routes, not just POST /payments

[Me7858]

Summary

Fixes #72.

Previously rate_limited_bucket returned None for every non-POST request, leaving GET /payments (list), GET /payments/:id, GET /payments/:id/webhooks, GET /health, GET /ready, GET /metrics, and any unknown POST route completely unprotected — they could be flooded without any restriction, enabling DoS and payment enumeration abuse.

Changes

src/api/mod.rs only — no new dependencies, no config changes.

• rate_limited_bucket now returns Some for every request:

  • Write/sensitive POSTs keep their named buckets: "payments", "merchants", "redeliver".
  • Everything else (all GETs, unknown POSTs) falls into a "default" bucket.

• New bucket_rate_multiplier function calibrates each bucket from the same RATE_LIMIT_REQUESTS_PER_SEC env variable:

  • Named write buckets: base rate × 1 (unchanged behaviour — POST /payments still gets 10 req/s at default config).
  • "default" bucket: base rate × 5 (e.g. 50 req/s at default config) — generous enough for normal polling without leaving reads unguarded.

• rate_limit_middleware passes the effective rate (base × multiplier) when creating per-key limiters, so each bucket is independently calibrated.

Acceptance criteria

• All routes have a default limit.
• Sensitive routes (POST /payments, POST /merchants, redelivery) have stricter per-bucket limits.

Testing

• cargo check --lib passes cleanly (no new dependencies introduced).
• The only compile error in the repo (crate::TaskHealth in main.rs) is pre-existing and unrelated to this change.