fix: set higher rate limits on staging via env vars

Make RATELIMIT_DEFAULT and RATE_LIMIT_AUTH configurable via environment
variables in the base Config class. Set staging-specific values
(2000/hour, 30 auth/min) in the deploy workflow env vars.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: QuinntyneBrown

.github/workflows/deploy-staging.yml

@@ -121,13 +121,16 @@ jobs:
           echo "API health check timed out"
           exit 1
 
-      - name: Ensure seed env var on staging API
+      - name: Ensure staging env vars on API
         continue-on-error: true
         run: |
           az containerapp update \
             --name $API_APP_NAME \
             --resource-group $AZURE_RESOURCE_GROUP \
-            --set-env-vars "SEED_ON_STARTUP=demo" 2>&1 || true
+            --set-env-vars \
+              "SEED_ON_STARTUP=demo" \
+              "RATELIMIT_DEFAULT=2000/hour" \
+              "RATE_LIMIT_AUTH=30/minute" 2>&1 || true
 
   # ──────────────────────────────────────────────────
   # Frontend: build SPA and deploy to Static Web App

backend/app/config.py

@@ -24,8 +24,8 @@ class Config:
     LOG_LEVEL = os.environ.get("LOG_LEVEL", "INFO")
     LOG_FORMAT = os.environ.get("LOG_FORMAT", "json")
 
-    RATELIMIT_DEFAULT = "200/hour"
-    RATE_LIMIT_AUTH = "5/minute"
+    RATELIMIT_DEFAULT = os.environ.get("RATELIMIT_DEFAULT", "200/hour")
+    RATE_LIMIT_AUTH = os.environ.get("RATE_LIMIT_AUTH", "5/minute")
 
 
 class DevelopmentConfig(Config):