chore(sova): pin dependencies, harden deploy files, add API rate limiting

[xsovad06]

Objective

Harden the deployment and dependency surface: add upper bounds to dependency pins, fix placeholder paths in deploy files, and add API rate limiting middleware.

Findings

[P2] No rate limiting on 148 API endpoints

• Location: sova/dashboard/app.py, all routers
• Issue: No rate limiting middleware. Network-exposed deployments are vulnerable to abuse.
• Recommendation: Add slowapi middleware with sensible defaults (60 req/min per IP). Exempt WebSocket and polling endpoints.

[P3] Dependency pinning too permissive

• Location: pyproject.toml
• Issue: All 18 production dependencies use >= without upper bounds. Only mcp>=1.0,<2.0 has a cap.
• Recommendation: Add upper bounds for packages with unstable APIs: fastapi>=0.115,<1.0, sqlalchemy>=2.0,<3.0, pydantic-settings>=2.2,<3.0.

[P4] Deployment files contain placeholder paths

• Location: deploy/sova-server.service:9
• Issue: /path/to/your/project placeholder will cause silent failures.
• Recommendation: Add validation guard: ExecStartPre=/bin/test -d $SOVA_PROJECT_DIR.

Files to Modify

• pyproject.toml
• deploy/sova-server.service
• deploy/com.sova.server.plist
• sova/dashboard/app.py

Estimated Effort

3 hours

Dependencies

None

---

Source: docs/HEALTH-AUDIT.md -- Health Audit 2026-08-12

Triage Assessment

Title: chore(sova): pin dependencies, harden deploy files, add API rate limiting
Has description: yes
Suitability: ready
Confidence: 85%
Complexity: complex
Missing context: none
Labels: type: infra, area: sova

Issue has structured sections indicating clear scope; ready for research.