[CT-37] Apply the configured rate limiter to the Axum router

[mftee]

Overview

rate_limit.rs defines build_rate_limiter(per_second, burst) using the governor crate, and AppConfig already parses/validates RATE_LIMIT_PER_SECOND and RATE_LIMIT_BURST from the environment (main.rs even logs these values on startup) — but build_rate_limiter is never called anywhere, and app() in lib.rs only applies .layer(TraceLayer::new_for_http()). The rate limiter is fully built but not wired into the request path, so the service has no actual rate limiting despite looking configured.

Files

• contract/src/lib.rs (app)
• contract/src/rate_limit.rs
• contract/src/main.rs

Acceptance Criteria

• Construct the rate limiter in main.rs using config.rate_limit_per_second/config.rate_limit_burst and pass it into AppState (or a tower layer)
• Apply it as a tower/axum middleware layer on app() so it actually rejects requests once the quota is exceeded
• Return 429 Too Many Requests with an appropriate body when the limit is hit
• Add an integration test that exceeds the configured burst and asserts a 429