Add simple rate limits for blockchain API endpoints

[sirpy]

Summary

This PR adds a simple middleware rate limiter for blockchain API read endpoints, with no signature/session requirements and no per-address ownership checks.

What is included

• Keeps existing cross-origin protection in middleware (403 for cross-site requests).
• Adds in-memory per-IP/per-endpoint fixed-window limits (60s) in src/proxy.ts.
• Applies limits to blockchain read routes:
  • /api/chains/*/addresses/*/balance -> 30/min
  • /api/chains/*/addresses/*/history -> 12/min
  • /api/chains/*/addresses/*/utxos -> 18/min
  • GET /api/chains/*/transactions/* (except /broadcast) -> 30/min
  • /api/chains/*/fee -> 60/min
• Returns 429 with Retry-After when limits are exceeded.

What is intentionally NOT included

• No wallet signature challenge/login flow.
• No per-address cookie/session gating.
• No ownership verification on reads.

Tests

• Added focused tests in src/proxy.rateLimit.test.ts.
• Verified:
  • Cross-origin blocking still works.
  • Each route key enforces its limit.
  • Counters are independent per IP and per endpoint.
  • Window resets after 60 seconds.
  • transactions/broadcast and unrelated routes are not rate-limited.

Run:

• yarn vitest run src/proxy.rateLimit.test.ts