Add rate-limiting to /api/stellar/rate

[Codex723]

ISSUE #14

---

Category: Stellar API Routes
Difficulty: good-first-issue
Labels: backend, api, security, good-first-issue

Files involved

• src/app/api/stellar/rate/route.ts

Background

The rate endpoint has no rate limiting and could be hammered to exhaust the free CoinGecko/ExchangeRate-API quota. Add a simple per-user or per-IP rate limit (e.g. 30 req/min).

This issue is part of the RemitX contributor backlog, generated from a full codebase audit of the project. RemitX is a Stellar-based remittance platform (Next.js 16, Prisma/Postgres, the Stellar SDK, and a Soroban escrow contract) currently at the "foundation build" stage: auth and the data model are real, while the Stellar integration, escrow contract internals, and several frontend pages are intentionally scaffolded with TODO(contributor) markers. See FOUNDATION.md in the repo root for the full project map and current status of every subsystem before starting.

Suggested approach

1. Review the current implementation in src/app/api/stellar/rate/route.ts and confirm the stub/gap described below.
2. The rate endpoint has no rate limiting and could be hammered to exhaust the free CoinGecko/ExchangeRate-API quota. Add a simple per-user or per-IP rate limit (e.g. 30 req/min).
3. Manually verify the change against the acceptance criteria below before opening a PR.
4. Update any relevant comments/docs (e.g. remove the TODO(contributor) marker this issue resolves, if applicable).

Acceptance criteria

• Excessive requests return 429
• Limit is configurable
• Does not break the 5-minute in-memory cache behavior

Notes for contributors

• Keep the change scoped to this issue — if you notice other stubs or bugs nearby, open a separate issue rather than bundling fixes into this PR.
• Match the existing code style in the surrounding file. This codebase uses TypeScript strict mode, Zod for input validation, and the shared successResponse/errorResponse helpers in src/lib/api-response.ts for every API route.
• If this issue depends on another issue in this area being done first, check the related issues below before starting — some subsystems (e.g. the escrow contract's release() authorization) need a design decision made before implementation can proceed.
• Please reference this issue number in your PR description, and check off acceptance criteria as you satisfy them.

Related issues in this area

• Wire POST /api/stellar/send to real rate + XDR build (end-to-end) #12
• Wire POST /api/stellar/submit to update Escrow record when applicable #13
• Add request idempotency key support to POST /api/stellar/send #15
• Add pagination metadata and sorting options to GET /api/transactions #16
• Add a GET /api/stellar/account route to fetch current user's Stellar balance #17