Rate limiting

Three places, on purpose:

Place	Examples
Kong routes	Login, OAuth, refresh, register, OTP, password, trial, deletion, social and feed routes
Redis in the service	Messaging send limiter, media music provider and Apple token limits, social search-history upsert, feed album search
Provider	Email quota table communication.email_provider_quota_usage

Kong limits protect the edge even if an app limiter is misconfigured. App limits protect a downstream provider (Apple, email) that Kong cannot see. Document a new limit in the service page and in kong.yml when it is an edge limit. Do not only hide it in code.