security(backend): add abuse controls and correlation IDs to mutation routes

[arisu6804]

Problem

High-volume retries or automated abuse can exhaust provider quotas and make incidents hard to trace.

Objective

Deliver a production-quality improvement to transfer, quote, and administrative mutation routes that creates measurable value for correctness, security, reliability, performance, or maintainability.

Implementation scope

• Add route-specific actor/client limits, safe 429 behavior, correlation propagation, and bounded limiter state.

Acceptance criteria

• Mutation routes have documented limits; abusive bursts are bounded; every accepted command can be correlated without leaking account data.

Required validation

• Burst, identity isolation, proxy trust, 429, correlation, and load tests.
• Existing tests and CI remain passing.
• Add regression coverage for the original failure mode.
• Do not weaken, delete, or skip unrelated tests to obtain a green build.

PR quality bar

• Keep the PR focused and explain design tradeoffs, compatibility impact, and test evidence.
• Avoid typo-only, documentation-only, cosmetic-only, or unrelated refactor submissions.

Out of scope

• Broad rewrites not required by the acceptance criteria.
• Changes to unrelated services, contracts, or user flows.

[guptakumarranjeet150]

Hey team,

I would love to take this on. My planned approach:

• Structure backend handlers for security(backend): add abuse controls and correlation IDs to mutation routes with strict input validation, proper HTTP error codes, and idempotent execution.
• Cover implementation with end-to-end integration tests for standard and edge-case inputs.

I am ready to start immediately—please assign this to me!

[shobhamerabacha-star]

Hello @maintainers,

I would love to take this on. My planned approach:

• Structure backend handlers for security(backend): add abuse controls and correlation IDs to mutation routes with strict input validation, proper HTTP error codes, and idempotent execution.
• Cover implementation with end-to-end integration tests for standard and edge-case inputs.

Happy to pick this up today—please assign to me!

[ranjeet150]

Hey team,

I would love to take this on. My planned approach:

• Structure backend handlers for security(backend): add abuse controls and correlation IDs to mutation routes with strict input validation, proper HTTP error codes, and idempotent execution.
• Cover implementation with end-to-end integration tests for standard and edge-case inputs.

Looking forward to contributing—please feel free to assign!