Add Rate Limiting

Add rate limiting to this API. Choose appropriate limits per endpoint based on expected usage. Implement with proper headers (X-RateLimit-Limit, X-RateLimit-Remaining, Retry-After). Return 429 Too Many Requests when exceeded. Use a strategy that works across multiple server instances if applicable.