[Fix] rate limiting not applied to GET /vaults and GET /positions Vercel handlers #176

Problem

checkRateLimit is only applied in the four /tx/ Vercel handlers (deposit, withdraw, add-trustline, submit). The GET /api/v1/vaults and GET /api/v1/positions/:publicKey handlers have no rate limiting, even though they trigger DeFiLlama HTTP fetches and Stellar RPC calls respectively. A scraper or accidental polling loop could exhaust upstream rate limits.

The Fastify layer has a global @fastify/rate-limit that covers all routes; the Vercel layer does not.

Fix

Add if (!checkRateLimit(req, res)) return; at the top of the vaults and positions Vercel handlers, consistent with the tx handlers.

Files affected

• api/v1/vaults/index.ts
• api/v1/vaults/[vaultId].ts
• api/v1/positions/[publicKey].ts