feat: implement IP-based rate limiting on scan endpoints

[aaryankamdar2005]

Before opening: make sure there is an issue tracking this work, and link it below. PRs without a linked issue may be closed without review.

Linked issue

(Add your issue number here if you have one, e.g., Closes #123. Otherwise, you can remove this section)

What this PR does

The /scan and /scan-url endpoints execute resource-intensive operations (running external security scanners and ML models). Currently, there is no rate limiting, allowing a single client to overwhelm the server by sending repeated scan requests.

This PR implements IP-based rate limiting using slowapi to protect the service from abuse and accidental resource exhaustion. It applies a default limit of 5 requests per minute per IP, configurable via the SCAN_RATE_LIMIT environment variable.

Type of change

• Bug fix
• New feature
• ML model / training pipeline
• Refactor (no behaviour change)
• Documentation
• Tests only

ML tier (if applicable)

• Tier 1 — Triage
• Tier 2 — Predictive
• Tier 3 — Autonomous
• Not ML-related

Stack affected

• Backend
• Frontend
• Both

---

Changes

Backend

• Added slowapi as a backend dependency.
• Created _scan_rate_limit dependency to guard /scan and /scan-url.
• Implemented _get_client_ip to correctly extract IP addresses from the X-Forwarded-For header (for proxy/load balancer deployments).
• Configured a global 429 error handler that returns a Retry-After header.
• Added README.md documentation for environment variables.
• Fixed a pre-existing issue in the test suite where anyio would attempt to run asyncio-specific concurrency tests under the trio backend by explicitly configuring anyio_backend in tests/conftest.py.

Frontend

• No frontend changes.

New dependencies

• slowapi

Database / schema changes

• None.

---

Testing

How did you test this?

• Added comprehensive integration tests (tests/test_rate_limit.py) verifying that the 6th request within the minute limit window correctly returns an HTTP 429.
• Verified that different IPs have independent quotas.
• Ran the full regression suite to ensure existing tests continue to pass.

Checklist

• Tested locally end-to-end
• New ML model falls back gracefully when model file is absent
• No new console.error or unhandled Python exceptions introduced
• Added or updated tests where applicable
• requirements.txt / package.json updated if new dependencies added
• New model files (.pkl, .pt, etc.) are gitignored, not committed

---

Anything reviewers should focus on

• Implementation choice: Used Depends(_scan_rate_limit) rather than @limiter.limit directly on the endpoints to sidestep an incompatibility between Python 3.13's from __future__ import annotations, FastAPI's dependency resolver, and slowapi's wrapper logic.
• conftest.py: Added tests/conftest.py to lock anyio tests to asyncio to fix the pre-existing CI test failures on [trio] tests.

Screenshots (if UI changed)

N/A

[github-actions]

🎉 Thank you @aaryankamdar2005 for submitting a Pull Request!

We're excited to review your contribution.

✅ Before Review

• Ensure all CI checks pass.
• Complete the PR template.
• Link the related issue.

⚡ Want faster reviews and contributor support?

Join our Discord community:

🔗 https://discord.gg/FcXuyw2Rs

Maintainers and mentors are active there and can help resolve blockers quickly.

Happy Contributing! 🚀