Implement rate limiting

[olevski]

This would be mostly on the gateway or at the ingress level.

But we need to:

• check that the ui is not affected
• find out what a reasonable limit is

Follow up from the pen test by @Operating3336

[leafty]

Echo has a rate limiting middleware we can use. This will protect the API (not the UI) and we can also try to push prom metrics.