Implement proper rate limiting for HF Spaces proxy environment

Instead of disabling rate limiting, configure it properly for
Hugging Face Spaces:
- Higher limits due to shared proxy infrastructure
- Custom key generator using multiple headers
- Skip validation to avoid proxy configuration errors
- Maintain security while working with HF infrastructure

server/index.ts

@@ -71,8 +71,20 @@ app.use(helmet({
 
 // Rate limiting configuration for production (HF Spaces) vs development
 const rateLimitConfig = process.env.NODE_ENV === 'production' ? {
-  // For HF Spaces - use a less strict approach since we can't reliably identify individual users
-  skip: () => true, // Disable rate limiting in production for now
+  // For HF Spaces - configure for proxy environment
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 1000, // Higher limit since we can't reliably identify individual users
+  message: {
+    error: "Too many requests, please try again later."
+  },
+  standardHeaders: true,
+  legacyHeaders: false,
+  // Use a combination of headers for better user identification in proxy environment
+  keyGenerator: (req) => {
+    return req.ip + '|' + (req.headers['x-forwarded-for'] || req.headers['cf-connecting-ip'] || req.connection.remoteAddress);
+  },
+  // Skip validation that was causing the errors
+  validate: false,
 } : {
   // For development - normal rate limiting
   windowMs: 15 * 60 * 1000, // 15 minutes
@@ -87,7 +99,17 @@ const rateLimitConfig = process.env.NODE_ENV === 'production' ? {
 const limiter = rateLimit(rateLimitConfig);
 
 export const strictLimiter = process.env.NODE_ENV === 'production' ? 
-  rateLimit({ skip: () => true }) : // Disable in production
+  rateLimit({
+    windowMs: 5 * 60 * 1000, // 5 minutes
+    max: 50, // More generous limit for production
+    message: {
+      error: "Too many requests, please try again later."
+    },
+    keyGenerator: (req) => {
+      return req.ip + '|' + (req.headers['x-forwarded-for'] || req.headers['cf-connecting-ip'] || req.connection.remoteAddress);
+    },
+    validate: false,
+  }) :
   rateLimit({
     windowMs: 1 * 60 * 1000, // 1 minute
     max: 10, // limit each IP to 10 requests per minute for sensitive endpoints