fix(api): respect RATE_LIMIT_PER_MIN for tool routes (#272)

Tool endpoints (/api/v1/tools/*) now honor the RATE_LIMIT_PER_MIN env var instead of a hardcoded 60/min: `0` disables per-tool limiting, `>0` uses the configured value, and unset falls back to 60. Merged on top of the section-based route refactor (#280).

Fixes #271.

apps/api/src/routes/tool-factory.ts

@@ -223,11 +223,20 @@ export function createToolRoute<T>(app: FastifyInstance, config: ToolRouteConfig
   };
   toolRegistry.set(config.toolId, resolved);
 
+  // Set up rate limiting
+  const toolRateLimit =
+    env.RATE_LIMIT_PER_MIN === 0
+      ? false
+      : {
+          max: env.RATE_LIMIT_PER_MIN || 60, // Keep fallback in case env var is not set
+          timeWindow: "1 minute",
+        };
+
   app.post(
     config.section
       ? `/api/v1/tools/${config.section}/${config.toolId}`
       : apiToolPath(config.toolId),
-    { config: { rateLimit: { max: 60, timeWindow: "1 minute" } } },
+    { config: { rateLimit: toolRateLimit } },
     async (request: FastifyRequest, reply: FastifyReply) => {
       // Check per-tool access before processing uploads
       const authUser = getAuthUser(request);