Rate limiter plug using Hammer 7.0+ for API endpoints.

Limits API requests based on:

• Authenticated users: by user_id
• Unauthenticated: by IP address

Default limits:

• Authenticated users: 1000 requests per hour
• Unauthenticated: 100 requests per hour