fix: replace in-memory rate limit with on-chain + cache hybrid (#223)

[GBOYEE]

Summary

Fixes the faucet rate limit bypass vulnerability where the in-memory Map was per-instance in serverless deployments, allowing cooldown bypass via cold starts or concurrent requests hitting different instances.

Changes

• Replaced rateLimitMap (module-level Map) with rateLimitCache + on-chain check
• New checkRateLimit() function uses a two-tier approach:
  1. Fast path: in-memory cache (works for single-instance deployments)
  2. Slow path: queries Stellar RPC for recent transactions from the requesting address (authoritative for serverless/multi-instance)
• On-chain check is fail-open (allows through if RPC check fails) to maintain faucet availability
• Moved RPC server creation before rate limit check so the on-chain query can execute

Security Impact

• Before: Any user could bypass the cooldown by sending concurrent requests or waiting for a cold start
• After: Rate limit is enforced even across multiple serverless instances by checking on-chain transaction history

Testing

• The on-chain check gracefully degrades if the RPC is unavailable (fail-open)
• Existing behavior preserved for single-instance deployments (fast path)

Closes #223

[vercel]

Someone is attempting to deploy a commit to the Oppia Software Labs Team on Vercel.

A member of the Team first needs to authorize it.