Make API rate limit configurable via environment variables

[dacopan]

Summary

Currently the api rate limiter is hardcoded in AppServiceProvider::boot():

RateLimiter::for('api', function (Request $request) {
    if (! $this->app->isProduction()) {
        return Limit::none();
    }

    return $request->user()
        ? Limit::perMinute(200)->by($request->user()->id)
        : Limit::perMinute(60)->by($request->ip());
});

For self-hosted instances that need a different throughput (e.g. bulk data imports/exports, integrations polling the API on a schedule, larger teams), the only way to change this today is patching the source and maintaining a custom build.

Proposal

Make these two values configurable via environment variables, keeping the current values as defaults so behavior is unchanged for anyone who doesn't set them:

• API_RATE_LIMIT_AUTH_PER_MINUTE (default: 200) — limit for authenticated requests
• API_RATE_LIMIT_GUEST_PER_MINUTE (default: 60) — limit for unauthenticated/IP-based requests

Implementation would follow Laravel conventions (reading from a config/rate-limiting.php file rather than calling env() directly inside the service provider, so it stays compatible with config:cache):

// config/rate-limiting.php
return [
    'api' => [
        'authenticated' => (int) env('API_RATE_LIMIT_AUTH_PER_MINUTE', 200),
        'guest' => (int) env('API_RATE_LIMIT_GUEST_PER_MINUTE', 60),
    ],
];

// AppServiceProvider.php
return $request->user()
    ? Limit::perMinute(config('rate-limiting.api.authenticated'))->by($request->user()->id)
    : Limit::perMinute(config('rate-limiting.api.guest'))->by($request->ip());

This is fully backward-compatible (defaults match current hardcoded values) and would also be documented in .env.example.

Why

Self-hosted users currently have no way to tune API throughput without forking and maintaining a custom Docker build. This is a small, low-risk change that only affects behavior for instances that explicitly opt in via env vars.

Happy to open a PR for this if the approach sounds good — wanted to check in first given the contribution guidelines.