Security fix: isolate health checks from admin API rate-limit bucket

[cursor]

Security review finding (Medium)

Issue: #125

Location: src/rate_limit.rs

Impact: Unauthenticated GET /api/v1/health shared the authenticated /api/* rate-limit bucket ({client_ip}:api). A remote attacker on the same source IP (NAT, reverse proxy, or co-located monitoring) could exhaust the 120/min default budget and block legitimate admin API calls (POST/DELETE /api/v1/streams, etc.) with 429 until the window resets.

Attack path:

• Attacker: unauthenticated remote client
• Input: repeated health probes
• Path: rate_limit::middleware runs before auth; all /api/* paths map to the api bucket
• Impact: admin API denial of service for the shared client IP

Fix

Classify /api/v1/health into a separate health bucket using default_max, so orchestrator probes no longer consume the authenticated admin API budget.

Tests

• rate_limit::tests::health_uses_separate_bucket_from_authenticated_api
• http::tests::health_rate_limit_does_not_exhaust_authenticated_api_budget
• Updated api_rate_limit_returns_429_when_exceeded to target protected routes

All 110 unit tests pass.

  

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}