Rate limit Captain kitchen-service updates

[sridharkalaibala]

Protect the new serveKitchenItems route with a per-IP request limit before authentication. This resolves the CodeQL missing-rate-limiting finding on the service-round update. The API route and MongoDB service tests pass locally (7 tests).

[github-actions]

Merged to develop. Anyone can test this - you do not need write access.

Try it at https://develop.posnic.io, or run it yourself:

git fetch origin develop && git checkout develop
npm install && npm --prefix api install
npm run dev   # then http://localhost:3000

When you have tested it, say what you did and what happened, and set
QA passed or QA failed. If you cannot set labels, just comment -
a maintainer will.

Reporting that something is broken is as useful as fixing it. It is
better found here than by a shopkeeper.