feat: make api rate limits configurable via env vars

backend/app/api.py

@@ -50,6 +50,8 @@ router = APIRouter(prefix="/api")
 # 环境变量
 ADMIN_SECRET = os.getenv("ADMIN_SECRET", "your-secret-key")
 SESSION_EXPIRE_DAYS = int(os.getenv("SESSION_EXPIRE_DAYS", "30"))
+RATE_LIMIT_GLOBAL = os.getenv("RATE_LIMIT_GLOBAL", "50/second")
+RATE_LIMIT_IP = os.getenv("RATE_LIMIT_IP", "5/second")
 
 
 class HealthResponse(BaseModel):
@@ -159,8 +161,8 @@ async def health_check():
 
 
 @router.post("/v1/auth/register", response_model=AuthResponse)
-@limiter.limit("10/second", key_func=lambda: "global")
-@limiter.limit("1/second")
+@limiter.limit(RATE_LIMIT_GLOBAL, key_func=lambda: "global")
+@limiter.limit(RATE_LIMIT_IP)
 async def register(request: Request, payload: RegisterRequest, db: Session = Depends(get_user_db)):
     username = payload.username.strip()
     if len(username) < 3 or len(payload.password) < 6:
@@ -185,8 +187,8 @@ async def register(request: Request, payload: RegisterRequest, db: Session = Dep
 
 
 @router.post("/v1/auth/login", response_model=AuthResponse)
-@limiter.limit("10/second", key_func=lambda: "global")
-@limiter.limit("1/second")
+@limiter.limit(RATE_LIMIT_GLOBAL, key_func=lambda: "global")
+@limiter.limit(RATE_LIMIT_IP)
 async def login(request: Request, payload: LoginRequest, db: Session = Depends(get_user_db)):
     user = db.query(User).filter(User.username == payload.username.strip()).first()
     if not user or not verify_password(payload.password, user.password_hash):