[Feature Request] Default/Easy Rate Limit strategy on all API routes

Describe the problem

rate limiting is a basic security problem that is left up to the developer. but it really shouldn't be, particularly for a backend/fullstack framework.

not handling this by default makes sveltekit apps with any significant api/backend calls extremely prone to Denial of Service/Denial of Wallet attacks out of the box.

Describe the proposed solution

it should be as easy as it is in comparable ecosystems:

• Rails
• Django

Alternatives considered

do nothing, almost guarantee nobody is doing this well if at all

Importance

nice to have

Additional Information

the next obvious need will be to document/pave the path of how to do the rate limiting on a per user or per team basis while letting other users/teams proceed

Start by reviewing how SvelteKit API routes are handled and compare the Rails and Django rate-limiting approaches linked in the issue. Define the default strategy, configuration surface, and per-user or per-team path; done requires an agreed implementation scope and coverage for all API routes.