raise queue.workolik.com edge rate limit for legitimate bulk orders

queue-api-proxy's Traefik rate limit was average=150/burst=50, live on the
container since before this repo existed (created 2026-05-30) but never
captured in docker-compose.yml - the container just kept running with
labels set at creation, invisible in git. Root-caused via a real bulk-order
test: 200 orders fired without client-side pacing hit 79 429s, all before
reaching NATS.

The gateway's per-request cost is cheap (validate + publish to JetStream),
and the worker pool absorbs bursts asynchronously once a message is queued
- the edge limit doesn't need to shape traffic, NATS already does that
downstream. It only needs to catch actual flood-scale abuse. Raised to
average=300/burst=400 so realistic bulk-order volume clears it comfortably.

Documented the labels in git for the first time so this isn't invisible
config drift going forward.

docker-compose.yml

@@ -21,6 +21,16 @@ services:
       - "traefik.http.routers.queue-api.tls.certresolver=letsencrypt"
       - "traefik.http.routers.queue-api.priority=100"
       - "traefik.http.services.queue-api.loadbalancer.server.port=8201"
+      # Edge rate limit (per source IP, Traefik default). Predates this repo -
+      # the running container (created 2026-05-30) had average=150/burst=50
+      # baked in at creation time, undocumented here since labels aren't
+      # re-read on an existing container. Raised to fit real bulk-order
+      # traffic: NATS + the worker pool absorb bursts fine once a request
+      # reaches the gateway, so this only needs to block actual flood-scale
+      # abuse, not legitimate customers batching orders (2026-07-30).
+      - "traefik.http.middlewares.queue-rl.ratelimit.average=300"
+      - "traefik.http.middlewares.queue-rl.ratelimit.burst=400"
+      - "traefik.http.routers.queue-api.middlewares=queue-rl"
 
   # Kubernetes dashboard proxy (kube.workolik.com ? K8s dashboard)
   k8s-dashboard-proxy: