Phase 1: Add rate limiting to the webhook endpoint

[dkwiebe]

Summary

The public POST /webhook/{token} route has no rate limiting, leaving it open to abuse or flooding.

Implementation

Add throttle:200,1 middleware to the webhook route in routes/web.php:

Route::post('webhook/{token}', SesWebhookController::class)->middleware('throttle:200,1');

200 requests per minute is a generous ceiling for legitimate SNS traffic but prevents runaway floods.

Acceptance Criteria

• Requests beyond the limit receive 429 Too Many Requests
• Normal SNS delivery volume is unaffected