(P4DEVOPS-9434) Wire RateLimiter middleware into API Rack stack

[smahima27]

Problem

The RateLimiter middleware was implemented in lib/vmpooler/api/rate_limiter.rb as part of P4DEVOPS-9434 but was never wired into the Rack middleware stack in lib/vmpooler/api.rb. As a result, rate_limiting_enabled: true in the vmpooler config had no effect — all requests passed through without rate limit checks.

This was discovered during dev environment testing where 105 rapid requests returned HTTP 200 instead of HTTP 429.

Fix

• Added rate_limiter to the list of required API components
• Inserted use Vmpooler::API::RateLimiter, redis, config into the Rack stack when rate_limiting_enabled is true in config

Testing

Verified in dev (https://vmpooler-dev.k8s.infracore.puppet.net):

• Before fix: 105 rapid requests → all HTTP 200 (no rate limiting)
• After fix: requests Store token metadata in vmpooler__vm__ Redis hash #101+ return HTTP 429 with X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After headers

Related

• P4DEVOPS-9434 — Rate limiting implementation PR Add rate limiting and input validation security enhancements #690