feat(phase-7): Advanced rate limiting with Redis and header redaction

- Implement tier-based rate limiting with rate-limiter-flexible
- Add Redis-backed rate limiters for different user tiers (free/pro/enterprise)
- Create comprehensive header redaction service for security
- Implement burst protection with per-minute limits
- Add organization and project-based rate limiting keys
- Create rate limiting middleware with proper error handling
- Integrate rate limits with tracking, bulk, and export endpoints
- Add header redaction to redirect tracking service
- Implement request logging with redacted sensitive headers
- Add comprehensive rate limit headers (limit, remaining, reset, tier)
- Support for anonymous vs authenticated rate limits
- Legacy endpoint rate limiting preserved for backward compatibility
- Admin functions for rate limit management and statistics
- Comprehensive test suite for all rate limiting scenarios

Security improvements:
- Sensitive header redaction (auth tokens, cookies, secrets)
- Partial redaction for debugging (admin mode)
- URL parameter redaction for sensitive data
- Request/response body redaction
- Configurable redaction levels

Backward compatibility: Maintained 100/hr rate limit for legacy endpoints

apps/api/package.json

@@ -39,7 +39,9 @@
     "mime-types": "^2.1.35",
     "csv-parser": "^3.0.0",
     "csv-writer": "^1.6.0",
-    "multer": "^1.4.5-lts.1"
+    "multer": "^1.4.5-lts.1",
+    "rate-limiter-flexible": "^5.0.3",
+    "ioredis": "^5.3.2"
   },
   "devDependencies": {
     "@types/express": "^4.17.21",
@@ -60,6 +62,7 @@
     "@types/markdown-it": "^13.0.7",
     "@types/mime-types": "^2.1.4",
     "@types/multer": "^1.4.11",
-    "@types/csv-parser": "^3.0.0"
+    "@types/csv-parser": "^3.0.0",
+    "@types/ioredis": "^5.0.0"
   }
 }