Rate-limit the key-injector proxy path (120/min) — only unthrottled sensitive route left

app/main.py

@@ -1580,6 +1580,7 @@ async def list_models(request: Request):
 
 
 @app.api_route("/v1/{path:path}", methods=["GET", "POST", "PUT", "DELETE", "PATCH"])
+@limiter.limit("120/minute")
 async def inject_key(request: Request, path: str):
     """Read the member's email from a header, inject their key, forward to LiteLLM."""
     # Verify the request came through the chat frontend, so a direct caller