fix: wire slowapi rate limiting - 5/min on analyze, 10/min on quick-analyze

app/api/main.py

@@ -1,6 +1,9 @@
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 from app.api.routes import router
+from slowapi import Limiter, _rate_limit_exceeded_handler
+from slowapi.util import get_remote_address
+from slowapi.errors import RateLimitExceeded
 
 app = FastAPI(
     title="AI Code Review Agent",
@@ -8,6 +11,10 @@ app = FastAPI(
     version="0.1.0"
 )
 
+limiter = Limiter(key_func=get_remote_address)
+app.state.limiter = limiter
+app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
+
 # Allow Gradio frontend to talk to FastAPI
 app.add_middleware(
     CORSMiddleware,

app/api/routes.py

@@ -1,5 +1,6 @@
-from fastapi import APIRouter, HTTPException, Depends
+from fastapi import APIRouter, HTTPException, Depends, Request
 from app.api.dependencies import verify_api_key
+from app.api.main import limiter
 import asyncio
 from fastapi import APIRouter, HTTPException
 from app.models.repository import RepositoryRequest, RepositoryResponse
@@ -20,7 +21,7 @@ router = APIRouter()
 def health_check():
     return {"status": "ok", "message": "AI Code Review Agent is running"}
 
-
+@limiter.limit("5/minute")
 @router.post("/analyze", response_model=EngineeringReport, dependencies=[Depends(verify_api_key)])
 async def analyze_repository(request: RepositoryRequest):
     """
@@ -56,7 +57,7 @@ async def analyze_repository(request: RepositoryRequest):
         if local_path:
             delete_repository(local_path)
 
-
+@limiter.limit("10/minute")
 @router.post("/quick-analyze", response_model=RepositoryResponse, dependencies=[Depends(verify_api_key)])
 async def quick_analyze(request: RepositoryRequest):
     """