api-gateway rate limiting keyed only by IP, not per-merchant

[therealjhay]

ProblemRate limits are IP-keyed; many merchants behind one NAT share a limit, and one noisy merchant can throttle others.

1. IP-only key.
2. No merchant dimension.
3. Shared-NAT fairness broken.

Solution

• Key by authenticated merchant when present, IP as fallback.
• Support nested limits.
• Test shared-NAT scenario.

Acceptance Criteria

• Authenticated requests limit per merchant.
• Anonymous requests limit per IP.
• pnpm --filter api-gateway build passes.

Note for Contributors: Write a clear PR description. Show the two-dimensional limiting test.

[Andreschuks101]

Hi! I'd like to contribute by resolving this issue. I've gone through the requirements and am confident I can implement the requested changes while adhering to the project's conventions.

[grantfox-oss]

🦊 GrantFox — @Andreschuks101 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #559)
2. Your PR will be reviewed by the Betta-Pay maintainers

Good luck! Track your progress on GrantFox.

[grantfox-oss]

🎉 This issue has been marked as completed on GrantFox as part of the Third Campaign campaign!

@Andreschuks101's PR #580 was approved and merged by @therealjhay.

🏆 @Andreschuks101: You earned 35 FoxPoints for this contribution! Your current tier: Explorer (459 total points). Track your full progress on GrantFox.

👏 Great work, @Andreschuks101! Keep contributing to Betta-Pay.