feat: add global and session rate limit

server/src/middleware/globalRateLimit.js

@@ -0,0 +1,6 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 60 * 1000, // 1 minute
+  max: 20,
+})

server/src/middleware/sessionRateLimit.js

@@ -0,0 +1,9 @@
+import { rateLimit } from 'express-rate-limit'
+
+export default rateLimit({
+  windowMs: 10 * 1000,
+  max: 1,
+  keyGenerator: (req) => {
+    return req.user ? req.user._id : req.ip
+  },
+})