appraisal-api: rate limiting and request size limits on x402 endpoint

[karagozemin]

Summary

Add basic rate limiting and a request body size cap to services/appraisal-api to protect the x402-gated endpoint from abuse.

Motivation

The appraisal endpoint performs paid on-chain settlement. Unbounded request volume or oversized payloads are a denial-of-service and cost vector.

Acceptance criteria

• Configurable per-IP / per-key rate limit with a 429 response.
• Max request body size returning 413 when exceeded.
• Tests covering allowed, throttled, and oversized requests.
• Config documented in the service README.

[Killerjunior]

Hi, I would love to work on this issue. Kindly assign.

[Killerjunior]

Hi, I would love to work on this issue. Kindly assign.

[rindicomfort]

Hello,

This issue matches my experience well. I’ve contributed through OnlyDust and participated in Drips Waves 1–5 and the GrantFox beta campaign.

I work with Rust, Soroban, Cairo, Solidity, and TypeScript, and I always focus on clean implementation, tests, and clear documentation.

I’m ready to pick this up and deliver within 24 hours if assigned.

[zeemscript]

Hello, I’ve gone through the requirements and I’m confident I can implement a proper solution that matches the acceptance criteria. Kindly assign this issue to me.