fix(api): limit recent transaction feed fan-out

[NateIsern]

Motivation

• Prevent an unauthenticated attacker from triggering excessive daemon/Mongo RPC lookups via the paginated /api/transactions feed by re-applying stricter rate limiting and avoiding per-item parent-transaction enrichment.
• Keep the feed behavior (route order) intact while ensuring it cannot multiply backend work through enrichInputPrevouts fan-out.

Description

• Apply the strictLimiter middleware to the plural route by registering app.use('/api/transactions', strictLimiter, transactionsRouter) in server/index.ts so the feed is protected by the same strict cap as other expensive RPC-backed endpoints.
• Prevent the recent-transaction page enrichment from triggering input prevout resolution by creating and sharing a zero prevoutLookupBudget and passing it to blockCache.getTransaction(..., { prevoutLookupBudget }) in server/routes/transactions.ts so only vout totals are used.
• Files modified: server/index.ts and server/routes/transactions.ts.

Testing

• Ran type checking with bun --bun run typecheck, which completed successfully.
• Ran the test suite with bun --bun run test, where 24 tests passed but the run failed due to environment/tooling issues (a z.enum import error in server/lib/http.test.ts and a jsdom/worker startup error), so no project-test regressions related to these changes were observed in the passing tests.

---

Codex Task

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.