[Adam-Ghanem]

What changed

• Add a bounded, thread-safe, rolling-window limiter for failed API key and OIDC authentication before verification (120 failures/60s per ASGI peer by default).
• Return 429 Retry-After for exhausted peer budgets; do not store or emit supplied keys, bearer tokens, or other credential content.
• Keep a bounded memory footprint (4,096 peers, shared overflow budget with stale-peer reclamation).
• Exclude successful requests and backend/identity provider outages from invalid-auth counters.
• Keep /api/health/live unthrottled for liveness monitoring.
• Document configuration and reverse proxy limitations; explicitly do not parse X-Forwarded-For in application code.
• Include unit/API tests for expiry, concurrency safety via locking, overflow bounds, malformed settings, spoofed forwarding headers, server failures, and pre-auth lockout.

Safety & deployment

This is a single-process defensive control, not a distributed anti-DDoS system. Behind a shared proxy, many users may share a peer; apply additional rate limits at a trusted edge with correctly validated forwarded identities. Existing authenticated endpoint rate limiting remains in place.

Merge gates

Merge only after both Python CI and Security CI pass on the current head commit.