The delivery API has no rate limiting, and an API key has no quota

Rate limiting exists on the auth routes only: OTP request, OTP verify, MFA verify, MFA disable, refresh. The public delivery API has none, and neither does any authenticated write route.

So an unauthenticated scraper reads as fast as it can ask, and a client with a valid API key can drive the database as hard as its network allows. On a news site that is a bad afternoon. On anything transactional it is the whole service.

## What to add

**Anonymous delivery reads.** A per-address limit, generous by default, so the protection is against a runaway client rather than against readers.

**Per API key.** A limit and a quota attached to the key itself, so one client cannot spend the capacity everyone shares. `barakoCMS/Features/ApiKeys/Endpoints.cs` already owns the key lifecycle and has somewhere to put it.

**Answer honestly.** 429 with `Retry-After`. A limiter that drops or stalls is indistinguishable from an outage from the client side.

## The two things to decide

**Where the counter lives.** In-process is per-instance, so the real limit is the configured one times the instance count. Shared state means Redis and a dependency. Say which, and write down the multiplication if it stays in-process, because an undocumented per-instance limit is a limit nobody can reason about.

**Whether this is core or a module.** It is middleware, so today it is core. See the module pipeline hook issue.

## Done when

- An anonymous caller past the limit gets 429 and `Retry-After`, not a slow 200.
- A per-key limit is settable when the key is created and enforced.
- The docs state whether the configured limit is per instance or per deployment.

Start with barakoCMS/Features/ApiKeys/Endpoints.cs and the module pipeline hook issue to understand key lifecycle and middleware placement. Decide whether counters use in-process state or shared Redis, and whether rate limiting belongs in core or a module. Done means anonymous and per-key limits return 429 with Retry-After, per-key limits are configurable at creation, and the deployment scope is documented.

Written by the indexing model from the issue text.