feat: IP-based rate limiting using Bucket4j

[aayushcodex17]

What

Adds per-IP rate limiting to protect the API from abuse and brute force attacks.

Implementation

• Library: bucket4j-core 8.10.1 — token bucket algorithm, in-memory, no Redis required
• Filter: RateLimitingFilter extends OncePerRequestFilter, runs before JWTAuthFilter
• Per-IP buckets: each IP gets its own Bucket stored in a ConcurrentHashMap

Rate Limits

Endpoint Type	Limit	Reason
/auth/login, /auth/signup, /auth/registerAsHotelManager	5 req/min	Brute force & credential stuffing protection
All other API endpoints	60 req/min	General abuse prevention
/webhook/**	Unlimited	Stripe webhooks must never be blocked

Response on Limit Exceeded

Returns HTTP 429 Too Many Requests in the existing ApiResponse format:

{
  "timestamp": "2026-04-15T10:30:00",
  "data": null,
  "error": {
    "httpStatus": "TOO_MANY_REQUESTS",
    "message": "Too many requests. Please slow down and try again in 42 second(s)."
  }
}

Headers

Header	Description
X-RateLimit-Limit	Max requests allowed in the window
X-RateLimit-Remaining	Requests remaining in current window
X-RateLimit-Retry-After-Seconds	Seconds to wait before retrying (on 429)

Proxy Support

Extracts real client IP from X-Forwarded-For header for deployments behind a reverse proxy or load balancer.

Files Changed

• pom.xml — added bucket4j-core dependency
• ratelimit/RateLimitingFilter.java — new filter
• security/WebSecurityConfig.java — registered filter before JWTAuthFilter