fix(webapp): keep public API keys on separate rate-limit buckets

Author: carderne

apps/webapp/app/services/apiRateLimit.server.ts

@@ -74,7 +74,8 @@ export const apiRateLimiter = authorizationRateLimitMiddleware({
 
     return {
       config: authenticatedEnv.environment.organization.apiRateLimiterConfig,
-      identifier: authenticatedEnv.environment.id,
+      // Public keys are browser-distributed, so keep them on per-key buckets.
+      identifier: authenticatedEnv.type === "PRIVATE" ? authenticatedEnv.environment.id : undefined,
     };
   },
   pathMatchers: [/^\/api/],