Document the global vs. quote-specific `rateLimiter` instances in the README

[Jagadeeshftw]

📌 Description

app.ts mounts two independent rateLimiter() instances: a default 30/minute limiter for all mutating requests, and a stricter 10/minute limiter mounted specifically on /api/v1/quote. This dual-limiter setup is only explained by a code comment in app.ts and isn't mentioned in the README, so integrators have no way to discover the tighter quote-specific limit without reading source.

🧩 Requirements and context

• Add a README section (or extend an existing rate-limiting section) explaining both limiters, their thresholds, and which routes each applies to.
• Mention the 429 response shape and that clients should implement backoff.
• Cross-reference src/app.ts and src/middleware/rateLimiter.ts line/section names so the doc stays discoverable from source.

🛠️ Suggested execution

• Edit README.md to add a "Rate limiting" subsection distinguishing the global and /api/v1/quote-specific limiters.
• Reference the exact defaults (DEFAULT_MAX = 30, DEFAULT_WINDOW_MS = 60_000 in src/middleware/rateLimiter.ts, and the { max: 10, windowMs: 60_000 } override in src/app.ts).

✅ Acceptance criteria

• README documents both rate limiter tiers with their thresholds and affected routes.
• No code changes required; documentation accurately reflects current app.ts/rateLimiter.ts values.

🔒 Security notes

N/A — documentation only; improves integrator awareness of rate-limit thresholds relevant to abuse-prevention design.

📋 Guidelines

• Minimum 95% test coverage
• Clear documentation
• Timeframe: 96 hours

[silentgeckoaudit3801]

I've prepared a README-only branch for this and can open the PR if assigned/confirmed:

• Branch: silentgeckoaudit3801:docs/rate-limiter-tiers
• Compare: main...silentgeckoaudit3801:docs/rate-limiter-tiers
• Scope: README.md only (+17/-6).
• Coverage: separates the global mutating-request limiter from the quote-specific limiter, documents 30/60s and 10/60s thresholds, links the values to src/middleware/rateLimiter.ts and src/app.ts, and documents the 429 / RATE_LIMITED response plus client backoff guidance.

I did not open a PR yet because the issue is currently unassigned.

[Jagadeeshftw]

That branch looks like a solid start — you're assigned, go ahead and open the PR against it, referencing this issue (e.g. Closes #119) so it links up.

Feel free to ask here if anything comes up. There's also a community chat: t.me/+vTbe0hOUKrFhNTJl