docs: document the API rate limits and the page ceiling

[anoziere]

Documents the API rate limits added by thelia/thelia#3883. The two settings that decide whether they work at all, trusted proxies and a shared cache, are the ones a shop otherwise discovers after it starts refusing its own customers.

New page

api/rate-limiting.md, sidebar_position: 8:

• what a capped caller gets: 429, Retry-After in seconds, and the same body every time, with a note on why the body says nothing about which cap was reached or whether the identifier names an account
• the seven THELIA_API_RATE_LIMIT_* variables with their defaults, what each is counted per, and which endpoints each covers
• why login has two figures (per caller and identifier, and per caller alone), and why the second has to stay well above the first
• why an authenticated caller is counted by account rather than by address
• the exemption list, with what it costs: address only, never a token, never login attempts, and an exempt address uncaps everything that can reach the API from it
• the proxy section, marked as read-before-deploying: without trusted proxies the application sees the proxy's address on every request and every visitor in the world shares one budget
• running on more than one server: a filesystem cache multiplies the effective cap by the number of servers, and pointing cache.app at Redis or Memcached holds it
• the log of refused authentications, why it has a file of its own, and what a line contains
• the test environment: the caps are real there too, and a suite that logs in for every case looks exactly like what they refuse

api/endpoints/_category_.json moves from position 8 to 9 so the new page sits after Filters & Pagination.

Updated pages

api/filters.md documented itemsPerPage with a default and no maximum, which is no longer true. The pagination table now carries the ceiling, and a new section explains it, shows that hydra:totalItems still reports the real size of the collection, and gives the two ways to change it (API Platform defaults, or per operation).

api/authentication.md gains a short rate limiting section before its next steps, so someone reading about the login endpoints is told that failed attempts are counted and that the proxy configuration matters.

Versioning

Every change is applied to docs/ and to versioned_docs/version-3.0/, which stay identical.

Companion to thelia/thelia#3883, which adds the limits themselves.