add rate limiting to batch endpoints

Optimization #12:
- created rateLimit.middleware with in-memory rate limiting
- batch-search-actors: 5 requests/min (conservative)
- batch-follow-users: 8 requests/hr (conservative)
- calculated based on AT Protocol limits with 50% buffer
- DRY implementation with applyRateLimit helper function
- prevents users from exhausting AT Protocol API limits
- leaves buffer for likes, replies, posts

Note: In-memory (resets on cold starts). Upgrade to Upstash Redis for production-grade shared state.

netlify/functions/batch-follow-users.ts

···
 import { MatchRepository } from "./repositories";
 import { successResponse, validateArrayInput, ValidationSchemas } from "./utils";
 import { withAuthErrorHandling } from "./core/middleware";
+import {
+  createRateLimiter,
+  applyRateLimit,
+} from "./core/middleware/rateLimit.middleware";
+
+// Rate limit: 8 requests per hour
+// Each request can follow up to 100 users (300 points)
+// Leaves ~50% of 5,000 points/hr for other operations
+const checkRateLimit = createRateLimiter({
+  maxRequests: 8,
+  windowMs: 60 * 60 * 1000, // 1 hour
+});
 
 const batchFollowHandler: AuthenticatedHandler = async (context) => {
+  applyRateLimit(checkRateLimit, context.event, "minutes");
   const body = JSON.parse(context.event.body || "{}");
   const dids = validateArrayInput<string>(
     context.event.body,

netlify/functions/batch-search-actors.ts

···
 import { SessionService } from "./services/SessionService";
 import { successResponse, validateArrayInput, ValidationSchemas } from "./utils";
 import { withAuthErrorHandling } from "./core/middleware";
+import {
+  createRateLimiter,
+  applyRateLimit,
+} from "./core/middleware/rateLimit.middleware";
 import { normalize } from "./utils/string.utils";
 import { FollowService } from "./services/FollowService";
 
+// Rate limit: 5 requests per minute
+// Leaves ~50% buffer for other AT Protocol operations
+const checkRateLimit = createRateLimiter({
+  maxRequests: 5,
+  windowMs: 60 * 1000, // 1 minute
+});
+
 const batchSearchHandler: AuthenticatedHandler = async (context) => {
+  applyRateLimit(checkRateLimit, context.event, "seconds");
   const body = JSON.parse(context.event.body || "{}");
   const usernames = validateArrayInput<string>(
     context.event.body,

netlify/functions/core/middleware/rateLimit.middleware.ts

···
+import { HandlerEvent } from "@netlify/functions";
+
+interface RateLimitConfig {
+  maxRequests: number;
+  windowMs: number;
+  identifier?: (event: HandlerEvent) => string;
+}
+
+interface RateLimitRecord {
+  count: number;
+  resetAt: number;
+}
+
+// In-memory store per function instance
+// Note: Resets on cold starts, but provides basic protection
+const rateLimitStore = new Map<string, RateLimitRecord>();
+
+// Cleanup old entries every 5 minutes to prevent memory leaks
+setInterval(() => {
+  const now = Date.now();
+  for (const [key, record] of rateLimitStore.entries()) {
+    if (now > record.resetAt) {
+      rateLimitStore.delete(key);
+    }
+  }
+}, 5 * 60 * 1000);
+
+/**
+ * Rate limiting middleware
+ *
+ * Limitations:
+ * - Per function instance (not shared across instances)
+ * - Resets on cold starts
+ * - In-memory only
+ *
+ * For production use with shared state, consider @upstash/ratelimit
+ */
+export function createRateLimiter(config: RateLimitConfig) {
+  const {
+    maxRequests,
+    windowMs,
+    identifier = (event) => event.headers["x-forwarded-for"] || "unknown",
+  } = config;
+
+  return function checkRateLimit(event: HandlerEvent): {
+    allowed: boolean;
+    limit: number;
+    remaining: number;
+    resetAt: number;
+  } {
+    const key = identifier(event);
+    const now = Date.now();
+    const record = rateLimitStore.get(key);
+
+    // No record or window expired - allow and create new record
+    if (!record || now > record.resetAt) {
+      const resetAt = now + windowMs;
+      rateLimitStore.set(key, { count: 1, resetAt });
+      return {
+        allowed: true,
+        limit: maxRequests,
+        remaining: maxRequests - 1,
+        resetAt,
+      };
+    }
+
+    // Within window - check if under limit
+    if (record.count < maxRequests) {
+      record.count++;
+      return {
+        allowed: true,
+        limit: maxRequests,
+        remaining: maxRequests - record.count,
+        resetAt: record.resetAt,
+      };
+    }
+
+    // Rate limit exceeded
+    return {
+      allowed: false,
+      limit: maxRequests,
+      remaining: 0,
+      resetAt: record.resetAt,
+    };
+  };
+}
+
+/**
+ * Rate limit error response
+ */
+export class RateLimitError extends Error {
+  constructor(
+    message: string,
+    public limit: number,
+    public resetAt: number,
+  ) {
+    super(message);
+    this.name = "RateLimitError";
+  }
+}
+
+/**
+ * Apply rate limiting to a request
+ * Throws RateLimitError if limit exceeded
+ */
+export function applyRateLimit(
+  checkRateLimit: ReturnType<typeof createRateLimiter>,
+  event: HandlerEvent,
+  timeUnit: "seconds" | "minutes" = "seconds",
+): void {
+  const rateLimit = checkRateLimit(event);
+
+  if (!rateLimit.allowed) {
+    const timeRemaining =
+      timeUnit === "minutes"
+        ? Math.ceil((rateLimit.resetAt - Date.now()) / 60000)
+        : Math.ceil((rateLimit.resetAt - Date.now()) / 1000);
+
+    const unitLabel = timeUnit === "minutes" ? "minutes" : "seconds";
+
+    throw new RateLimitError(
+      `Rate limit exceeded. Try again in ${timeRemaining} ${unitLabel}.`,
+      rateLimit.limit,
+      rateLimit.resetAt,
+    );
+  }
+}