RV-S9: rate limiter uses first 8 chars of any X-API-Key as identity before auth #183

What happened

External repo review at commit c7bebd1 reproduced: the rate limiter treats the first 8 characters of any supplied X-API-Key as the caller's identity before validating it. Reproduction: same client received statuses 422, 429, 422 by changing an arbitrary header value. Login endpoint does not require a valid service key.

Code path: api/ratelimit.py L90–103.

Account lockout (#102) remains a separate protection.

Why this matters

Any unauthenticated attacker can bypass per-caller rate limits by rotating the X-API-Key prefix. The limiter was supposed to budget unauthenticated traffic; it currently budgets per-prefix-string instead. In practice this means brute-force protection on the login endpoint is weaker than designed.

Proposed

1. Rate-limit unauthenticated traffic by a trusted client identity (source IP, or a server-generated session cookie set on first contact).
2. Only apply service-key identity to rate limiting after the key is validated.
3. Test: rotate 10 invalid API keys from the same client; limiter should treat them as one client, not 10.

Done when

• Reproduction (3 requests with rotating X-API-Key from same client) hits the rate limit at the second request, not the third.
• Valid-key clients still get per-key budgets.
• Account lockout and existing valid-auth paths unaffected.

Reference

Tracker row G42. Repo review finding RV-S9. Related to M2 identity (#92, #102).