Feature: Implement rate limiting for API requests

[basher83]

Feature Request

Add rate limiting capabilities to prevent abuse and ensure API stability.

Context

This feature was identified in issue #17 but intentionally deferred as a future enhancement. The core security features (URL validation, input sanitization, parameter validation) have been implemented.

Proposed Implementation

1. Client-Side Rate Limiting

• Implement token bucket or sliding window algorithm
• Track requests per time window
• Configurable limits via environment variables

2. Exponential Backoff

• Automatic retry with exponential backoff on rate limit errors
• Respect Retry-After headers from Zammad API
• Maximum retry attempts configuration

3. Circuit Breaker Pattern

• Open circuit after consecutive failures
• Half-open state for testing recovery
• Automatic recovery after cooldown period

4. Configuration

ZAMMAD_RATE_LIMIT_ENABLED=true
ZAMMAD_RATE_LIMIT_REQUESTS=100  # requests per minute
ZAMMAD_RATE_LIMIT_WINDOW=60     # seconds
ZAMMAD_MAX_RETRIES=3
ZAMMAD_RETRY_BACKOFF_BASE=2     # exponential base

Technical Considerations

• Use tenacity library for retry logic with exponential backoff
• Store rate limit state in memory (or Redis for distributed deployments)
• Add prometheus metrics for monitoring rate limit hits
• Consider per-endpoint rate limits vs global limits

Acceptance Criteria

• Rate limiting respects configured thresholds
• Automatic retry with exponential backoff on 429 responses
• Circuit breaker prevents cascading failures
• Configuration via environment variables
• Metrics/logging for rate limit events
• Unit tests for rate limiting logic
• Documentation in README.md

Priority

Low - Nice to have for production deployments

References

• Deferred from issue Security: Implement URL validation and input sanitization #17
• Related to CLAUDE.md "Security Notes"
• Tenacity library: https://github.com/jd/tenacity