Implement rate limiting and DDoS protection

[abk-tech]

Title: Implement Rate Limiting & DDoS Protection for Contract Operations

Overview

This PR introduces configurable rate limiting and DDoS protection across contract operations to prevent abuse of registration, verification, and revocation workflows.

Previously, the contract had no active throttling mechanism despite an existing rate_limit.rs implementation. This allowed malicious actors to repeatedly invoke contract operations, potentially flooding ledger state, degrading indexer performance, and increasing operational costs.

What Changed

• Rate Limiting Integration
• Integrated rate limiting into all contract entry points.
• Enforced validation before executing registration, verification, and revocation operations.
• Added protection for both direct contract calls and service-level invocation paths.
• Configurable Limits
• Added rate limit configuration support in config.rs.
• Introduced separate limits for:
• Per-issuer activity
• Per-address activity
• Added configurable burst capacity and refill settings.
• Persistent Rate Limit State
• Implemented persistent tracking of rate limit state.
• Supports storage in contract ledger state (or Redis where applicable).
• Ensures rate limiting remains effective across contract invocations and node restarts.
• Error Handling
• Added typed rate limit errors.
• Returns retry guidance when limits are exceeded.
• Provides consistent error responses across protected operations.

Observability & Metrics
Added rate limit telemetry and monitoring.

Tracks:

• Rate limit violations
• Token consumption
• Bucket refills/resets
• Request throttling events
• Extended metrics reporting for operational visibility.
• Documentation
• Added production configuration guidance.
• Documented tuning recommendations for different workload profiles.
• Included examples for configuring issuer and address limits.

Testing
Added comprehensive test coverage for:

• Burst allowance behavior

• Token refill mechanics

• Per-issuer throttling

• Per-address throttling

• Rate limit reset scenarios

• Concurrent caller behavior

• Error responses and retry-after handling

• Files Updated

• src/lib.rs

• src/rate_limit.rs

• src/config.rs

• src/stellar.rs

• src/metrics.rs

• src/test.rs

• Cargo.toml

• README.md

Impact

This change significantly reduces the risk of contract abuse, ledger pollution, and denial-of-service attacks while providing configurable controls that can be tuned for legitimate high-volume issuers and production workloads.

[MaryammAli]

LGTM