feat: harden rate limits

[mantariksh]

Problem

We currently do not limit the number of submissions per IP per minute. Instead, we only log a message when a threshold is exceeded. This means that in case of a DDoS attempt, there is a risk of downstream systems (particularly those linked via webhook) being affected indirectly.

Solution

Harden the rate-limiting by return HTTP 429.

Some UI issues surfaced as a result of this change. In particular, the /auth/sendotp and submissions endpoints return different error message shapes. As a result, it was not clear what shape the limitRate message should return, since it is shared between those two endpoints.

I decided to change the /auth/sendotp endpoint to return an object with a message key instead of a plain string since this gives us the flexibility to return more error metadata in future. This was technically a backwards-incompatible change, but the impact is minimal since old clients will simply see the default error message if their OTP emails fail to be sent, which is a rare situation anyway.

Screenshots

Tests

• Change the SUBMISSIONS_RATE_LIMIT and AUTH_OTP_RATE_LIMIT env vars to 3 each (choosing 3 instead of 0/1/2 so that hopefully it won't affect the other tests running concurrently)
• Attempt to make 4 email mode submissions across at least 2 different forms within 1 minute. The 4th submission should return 429 with a "please try again in one minute" error message. Cloudwatch should contain a limitRate log message with your IP address.
• Make 3 email mode submissions within 1 minute, then another one from a different IP address . The one from the different IP address should go through.
• Attempt to make 4 encrypt mode submissions across at least 2 different forms within 1 minute. The 4th submission should return 429 with a "please try again in one minute" error message. Cloudwatch should contain a limitRate log message with your IP address.
• Make 3 email encrypt submissions within 1 minute, then another one from a different IP address . The one from the different IP address should go through.
• Attempt to resend auth OTP 4 times within 1 minute. The 4th submission should return 429 with a "please try again in one minute" error message. Cloudwatch should contain a limitRate log message with your IP address.