feat: Add rate limiting middleware with SlowAPI

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

.env.demo

@@ -47,6 +47,31 @@ MAX_UPLOAD_SIZE=1073741824
 # Always set to 'nosniff' when enabled
 # SECURITY_HEADER_X_CONTENT_TYPE_OPTIONS_ENABLED=true
 
+# **Rate Limiting** (see SECURITY_AUDIT.md and docs/API.md)
+# Protects against DoS attacks and API abuse by limiting request rates per IP/user
+# Enabled by default - highly recommended for production
+RATE_LIMITING_ENABLED=true
+
+# Default rate limit for all API endpoints (format: count/period)
+# Periods can be: second, minute, hour, day
+# Default: 100 requests per minute per IP/user
+RATE_LIMIT_DEFAULT=100/minute
+
+# Rate limit for file upload endpoints
+# Lower limit to prevent resource exhaustion from large file uploads
+# Default: 20 uploads per minute per IP/user
+RATE_LIMIT_UPLOAD=20/minute
+
+# Rate limit for document processing endpoints (OCR, metadata extraction)
+# These operations are resource-intensive
+# Default: 30 requests per minute per IP/user
+RATE_LIMIT_PROCESS=30/minute
+
+# Rate limit for authentication endpoints
+# Strict limit to prevent brute force attacks
+# Default: 10 attempts per minute per IP
+RATE_LIMIT_AUTH=10/minute
+
 # **Authentication**
 AUTH_ENABLED=true
 # Generate a secure random string, for example: