Add comprehensive rate limiting module with policy management (#64)

* Add RateLimiting module with framework-level rate limiting support

- Add rate limiting abstractions to SimpleModule.Core: policy types (FixedWindow,
  SlidingWindow, TokenBucket), target modes (IP, User, IpAndUser, Global),
  IRateLimitBuilder, IRateLimitPolicyRegistry, and .RateLimit() endpoint extension
- Add ConfigureRateLimits() lifecycle hook to IModule interface
- Integrate ASP.NET Core RateLimiter middleware in SimpleModule.Hosting with
  automatic policy registration from module definitions
- Add X-RateLimit-* response headers via RateLimitHeaderMiddleware
- Update source generator to discover and wire ConfigureRateLimits on modules
- Create RateLimiting module with:
  - Contracts: RateLimitRule entity, CRUD DTOs, IRateLimitingContracts
  - Implementation: DbContext, CRUD service, REST endpoints, permissions
  - Admin UI: React/Inertia page for managing stored rules and viewing active policies
  - 4 built-in policies: fixed-default, sliding-strict, token-bucket, auth-strict
  - Navigation menu in admin sidebar
- Add 18 unit tests covering policy registry and CRUD service
- Register module in Host project, solution, and test infrastructure

* Simplify RateLimiting module: address code review findings

- Use Dictionary<string, RateLimitPolicyDefinition> for O(1) policy lookup
  instead of linear List.Find on every rate-limited request
- Pre-build rate limiter options at registration time instead of allocating
  per-request in the partition factory
- Accept IRateLimitPolicyRegistry interface instead of concrete type in
  AddSimpleModuleRateLimiting to avoid leaking implementation details
- Extract CreateRequestValidator class following the codebase convention
  used by Products, Orders, and Tenants modules
- Extract API_BASE constant in Admin.tsx to eliminate hardcoded URL strings
- Fix handleToggle to send only UpdateRateLimitRuleRequest fields instead
  of spreading the full entity (which includes id, policyName, timestamps)

* Add E2E tests for RateLimiting module

- Add page object (RateLimitingAdminPage) with selectors for heading,
  tabs, create dialog, rules table, and toggle/delete actions
- Add smoke tests: page loads, tabs visible, active policies table
- Add flow tests: full CRUD via API (create, read, update, delete),
  active policies endpoint verification, UI visibility after API create,
  create dialog opens from admin page

* ci: retrigger CI after merge with main

* Fix E2E failures: add EnsureTablesCreated for RateLimitingDbContext

The RateLimiting admin page returned 500 because the database tables
were never created in the test infrastructure. Added the missing
EnsureTablesCreated<RateLimitingDbContext> call to the WebApplicationFactory
initialization alongside all other module contexts.

Also adds integration tests that verify the admin page and API endpoints
return 200 for authenticated admin users.

* Add EF Core migration for RateLimiting module

The E2E tests failed because the RateLimiting_Rules table didn't exist
in the SQLite database. The server uses MigrateAsync() on the HostDbContext
which requires an explicit migration to create new tables.

This migration creates the RateLimiting_Rules table with all columns,
the unique index on PolicyName, and also includes pending BackgroundJobs
and Email tables from the main branch merge.

Author: antosubash

SimpleModule.slnx

@@ -114,6 +114,11 @@
     <Project Path="modules/Localization/src/SimpleModule.Localization/SimpleModule.Localization.csproj" />
     <Project Path="modules/Localization/tests/SimpleModule.Localization.Tests/SimpleModule.Localization.Tests.csproj" />
   </Folder>
+  <Folder Name="/modules/RateLimiting/">
+    <Project Path="modules/RateLimiting/src/SimpleModule.RateLimiting.Contracts/SimpleModule.RateLimiting.Contracts.csproj" />
+    <Project Path="modules/RateLimiting/src/SimpleModule.RateLimiting/SimpleModule.RateLimiting.csproj" />
+    <Project Path="modules/RateLimiting/tests/SimpleModule.RateLimiting.Tests/SimpleModule.RateLimiting.Tests.csproj" />
+  </Folder>
   <Folder Name="/modules/Email/">
     <Project Path="modules/Email/src/SimpleModule.Email.Contracts/SimpleModule.Email.Contracts.csproj" />
     <Project Path="modules/Email/src/SimpleModule.Email/SimpleModule.Email.csproj" />

framework/SimpleModule.Core/IModule.cs

@@ -7,6 +7,7 @@
 using SimpleModule.Core.Authorization;
 using SimpleModule.Core.FeatureFlags;
 using SimpleModule.Core.Menu;
+using SimpleModule.Core.RateLimiting;
 using SimpleModule.Core.Settings;
 
 namespace SimpleModule.Core;
@@ -21,6 +22,7 @@ virtual void ConfigurePermissions(PermissionRegistryBuilder builder) { }
     virtual void ConfigureSettings(ISettingsBuilder settings) { }
     virtual void ConfigureFeatureFlags(IFeatureFlagBuilder builder) { }
     virtual void ConfigureAgents(IAgentBuilder builder) { }
+    virtual void ConfigureRateLimits(IRateLimitBuilder builder) { }
 
     /// <summary>
     /// Called once during application startup after all services are built but before

framework/SimpleModule.Core/RateLimiting/EndpointRateLimitExtensions.cs

@@ -0,0 +1,13 @@
+using Microsoft.AspNetCore.Builder;
+
+namespace SimpleModule.Core.RateLimiting;
+
+public static class EndpointRateLimitExtensions
+{
+    public static TBuilder RateLimit<TBuilder>(this TBuilder builder, string policyName)
+        where TBuilder : IEndpointConventionBuilder
+    {
+        builder.RequireRateLimiting(policyName);
+        return builder;
+    }
+}

framework/SimpleModule.Core/RateLimiting/IRateLimitBuilder.cs

@@ -0,0 +1,6 @@
+namespace SimpleModule.Core.RateLimiting;
+
+public interface IRateLimitBuilder
+{
+    IRateLimitBuilder Add(RateLimitPolicyDefinition policy);
+}

framework/SimpleModule.Core/RateLimiting/IRateLimitPolicyRegistry.cs

@@ -0,0 +1,7 @@
+namespace SimpleModule.Core.RateLimiting;
+
+public interface IRateLimitPolicyRegistry
+{
+    IReadOnlyList<RateLimitPolicyDefinition> GetPolicies();
+    RateLimitPolicyDefinition? GetPolicy(string name);
+}

framework/SimpleModule.Core/RateLimiting/RateLimitPolicyDefinition.cs

@@ -0,0 +1,15 @@
+namespace SimpleModule.Core.RateLimiting;
+
+public sealed class RateLimitPolicyDefinition
+{
+    public required string Name { get; init; }
+    public RateLimitPolicyType PolicyType { get; init; } = RateLimitPolicyType.FixedWindow;
+    public RateLimitTarget Target { get; init; } = RateLimitTarget.Ip;
+    public int PermitLimit { get; init; } = 60;
+    public TimeSpan Window { get; init; } = TimeSpan.FromMinutes(1);
+    public int SegmentsPerWindow { get; init; } = 4;
+    public int TokenLimit { get; init; } = 100;
+    public int TokensPerPeriod { get; init; } = 10;
+    public TimeSpan ReplenishmentPeriod { get; init; } = TimeSpan.FromSeconds(10);
+    public int QueueLimit { get; init; }
+}

framework/SimpleModule.Core/RateLimiting/RateLimitPolicyRegistry.cs

@@ -0,0 +1,19 @@
+namespace SimpleModule.Core.RateLimiting;
+
+public sealed class RateLimitPolicyRegistry : IRateLimitBuilder, IRateLimitPolicyRegistry
+{
+    private readonly Dictionary<string, RateLimitPolicyDefinition> _policies = new(
+        StringComparer.OrdinalIgnoreCase
+    );
+
+    public IRateLimitBuilder Add(RateLimitPolicyDefinition policy)
+    {
+        _policies[policy.Name] = policy;
+        return this;
+    }
+
+    public IReadOnlyList<RateLimitPolicyDefinition> GetPolicies() =>
+        _policies.Values.ToList().AsReadOnly();
+
+    public RateLimitPolicyDefinition? GetPolicy(string name) => _policies.GetValueOrDefault(name);
+}

framework/SimpleModule.Core/RateLimiting/RateLimitPolicyType.cs

@@ -0,0 +1,8 @@
+namespace SimpleModule.Core.RateLimiting;
+
+public enum RateLimitPolicyType
+{
+    FixedWindow,
+    SlidingWindow,
+    TokenBucket,
+}

framework/SimpleModule.Core/RateLimiting/RateLimitTarget.cs

@@ -0,0 +1,9 @@
+namespace SimpleModule.Core.RateLimiting;
+
+public enum RateLimitTarget
+{
+    Ip,
+    User,
+    IpAndUser,
+    Global,
+}

framework/SimpleModule.Generator/Discovery/DiscoveryData.cs

@@ -126,6 +126,7 @@ internal readonly record struct ModuleInfoRecord(
     bool HasConfigureSettings,
     bool HasConfigureFeatureFlags,
     bool HasConfigureAgents,
+    bool HasConfigureRateLimits,
     bool HasRazorComponents,
     string RoutePrefix,
     string ViewPrefix,
@@ -146,6 +147,7 @@ public bool Equals(ModuleInfoRecord other)
             && HasConfigureSettings == other.HasConfigureSettings
             && HasConfigureFeatureFlags == other.HasConfigureFeatureFlags
             && HasConfigureAgents == other.HasConfigureAgents
+            && HasConfigureRateLimits == other.HasConfigureRateLimits
             && HasRazorComponents == other.HasRazorComponents
             && RoutePrefix == other.RoutePrefix
             && ViewPrefix == other.ViewPrefix
@@ -167,6 +169,7 @@ public override int GetHashCode()
         hash = HashHelper.Combine(hash, HasConfigureSettings.GetHashCode());
         hash = HashHelper.Combine(hash, HasConfigureFeatureFlags.GetHashCode());
         hash = HashHelper.Combine(hash, HasConfigureAgents.GetHashCode());
+        hash = HashHelper.Combine(hash, HasConfigureRateLimits.GetHashCode());
         hash = HashHelper.Combine(hash, HasRazorComponents.GetHashCode());
         hash = HashHelper.Combine(hash, (RoutePrefix ?? "").GetHashCode());
         hash = HashHelper.Combine(hash, (ViewPrefix ?? "").GetHashCode());
@@ -462,6 +465,7 @@ internal sealed class ModuleInfo
     public bool HasConfigureSettings { get; set; }
     public bool HasConfigureFeatureFlags { get; set; }
     public bool HasConfigureAgents { get; set; }
+    public bool HasConfigureRateLimits { get; set; }
     public bool HasRazorComponents { get; set; }
     public string RoutePrefix { get; set; } = "";
     public string ViewPrefix { get; set; } = "";