Rate Limiting & Abuse Prevention

[emperor42]

No throttling is applied to login, registration, or import endpoints. An attacker could brute‑force passwords or flood the server with large multipart uploads.