feat(api): add rate limiting to endpoint passthrough API

[zwpaper]

Summary

• Add per-user rate limiting using leaky-bucket algorithm for endpoint forwarding
• Require authentication for endpoint access (returns 401 if no user)
• Return 429 Too Many Requests when rate limit is exceeded
• Improve error handling: forward 4xx errors from upstream, return 504 Gateway Timeout on timeout errors
• Refactor: rename agent.rs to endpoint.rs, extract rate_limit.rs module

Configuration

Rate limiting is configured per-endpoint via the user_quota.requests_per_minute field in config.toml:

[[endpoints]]
name = "pochi"
api_route = "https://api.openai.com"
timeout = 5000
user_quota = { requests_per_minute = 30 }
headers = { Authorization = "Bearer xxx" }

Test plan

• Test endpoint access without authentication returns 401
• Test rate limiting triggers 429 after exceeding requests_per_minute
• Test upstream 4xx errors are forwarded correctly
• Test timeout returns 504 Gateway Timeout

🤖 Generated with Pochi | Task

---

Requests per minute would be converted into qps, and applied every second:

1800 requests per minutes:

[codecov]

Codecov Report

❌ Patch coverage is 0% with 69 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (next@a24a1b5). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
crates/tabby/src/routes/endpoint.rs	0.00%	31 Missing ⚠️
crates/tabby/src/routes/rate_limit.rs	0.00%	27 Missing ⚠️
crates/tabby/src/serve.rs	0.00%	11 Missing ⚠️

❌ Your patch status has failed because the patch coverage (0.00%) is below the target coverage (75.00%). You can increase the patch coverage or adjust the target coverage.

Additional details and impacted files

@@           Coverage Diff           @@
##             next    #4439   +/-   ##
=======================================
  Coverage        ?   54.17%           
=======================================
  Files           ?      229           
  Lines           ?    27113           
  Branches        ?        0           
=======================================
  Hits            ?    14689           
  Misses          ?    12424           
  Partials        ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.