Implement Sliding Window Rate Limit Header Exposure (X-RateLimit-Remaining)

[hardikkaurani]

🟡 Intermediate Issue

Problem

The RateLimitingMiddleware enforces rate limits but does not expose standard HTTP rate limit headers to API consumers.

Why It Matters

Exposing X-RateLimit-Limit, X-RateLimit-Remaining, and X-RateLimit-Reset headers allows API clients to implement intelligent backoff strategies.

Suggested Files

• backend/app/core/production_security.py

Definition of Done

• Rate limit headers attached to all API responses.
• Headers tested via pytest with mock Redis counters.
• Existing rate limiting behavior unchanged.

[hardikkaurani]

👋 Maintainer Solution Guide:

1. Open backend/app/core/production_security.py
2. In the RateLimitingMiddleware, after checking the rate limit counter, attach these headers to the response:
   • X-RateLimit-Limit: Max requests per window
   • X-RateLimit-Remaining: Requests left in current window
   • X-RateLimit-Reset: Epoch timestamp when window resets
3. Add a pytest test verifying these headers appear on API responses

Important for API consumers — great intermediate contribution! 📊