feat: add Redis leaky bucket rate limiter with Sybil analysis flagging

[GazzyLee]

feat: Redis Leaky Bucket Rate Limiter with Sybil Analysis

Adds per-wallet rate limiting using a Redis-backed Leaky Bucket algorithm to protect /api endpoints from scraping and bot abuse.

Changes

• Leaky Bucket rate limiter (leakyBucketRateLimiter.js) — Atomic Redis Lua script enforcing configurable token capacity per wallet. Temporarily blocks offenders (default 5 min).
• Sybil Analysis flagging (sybilAnalysisService.js) — Wallets exceeding a violation threshold are flagged in a ranked sorted set with metadata (IP, endpoint, timestamp) for admin review.
• Express middleware (rateLimiter.js) — Extracts wallet from auth context, enforces limits, returns 429 + Retry-After headers. Fails open on Redis errors.
• Redis client (redis.js) — Singleton ioredis client with retry strategy and graceful shutdown.
• Tests (rateLimiter.test.js) — Full coverage of bucket logic, blocking, Sybil flagging, middleware integration, and Redis failure handling (mocked).

Config (env vars)

REDIS_URL, RATE_LIMIT_CAPACITY (60), RATE_LIMIT_LEAK_RATE (1/s), RATE_LIMIT_BLOCK_SECONDS (300), SYBIL_THRESHOLD (3)

Closes #53

[drips-wave]

@GazzyLee Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits