Fix rate limiting not disabled when ENV is unset in local dev

[Copilot]

isLocalDev only checked for "dev" and "development", but config/config.go treats ENV="" identically (same switch fallthrough). With ENV unset, rate limiting remained enabled despite the local dev intent.

Changes

• api/server.go: Add config.Env == "" to isLocalDev to match config.go semantics:

// Before
isLocalDev := config.Env == "dev" || config.Env == "development"

// After
isLocalDev := config.Env == "dev" || config.Env == "development" || config.Env == ""

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.