adjust rate limiter config

[wojcik91]

• reduce rate-limiter scope to just API routes
• make the defaults more permissive

Continued from #2782

[Copilot]

Pull request overview

Adjusts the core HTTP rate limiter so it only affects API endpoints (instead of also impacting static assets) and relaxes the default limiter settings. This continues the baseline HTTP security work from #2782 by refining the operational impact of the new middleware.

Changes:

• Refactors build_webapp to assemble API routes into a separate router and apply the governor rate limiter there before merging into the main (static) router.
• Moves rate-limiter configuration into build_webapp and threads DefGuardConfig into webapp construction.
• Increases default rate-limit settings (per_second, burst) to be more permissive.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
crates/defguard_core/src/lib.rs	Refactors router composition; applies rate limiting only to API router and merges into main webapp; updates web server startup wiring.
crates/defguard_common/src/config.rs	Updates default rate limiter config values (100 req/s, burst 1000).
crates/defguard_core/tests/integration/api/common/mod.rs	Updates integration test helper to pass config into build_webapp.
crates/defguard_core/tests/integration/api/proxy_certs.rs	Updates proxy cert integration tests to pass config into build_webapp.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.