fix(pg-pkg): add rate limiting to /v2 API endpoints

[dobby-coder]

Hardening work on the pg-pkg API surface.

Task

pg-pkg has no rate-limiting middleware. Add per-IP rate limiting (e.g. via actix-governor) to the /v2 scope in pg-pkg/src/server.rs, with tighter limits on the /start, /key, and /api-key/validate endpoints.

• add actix-governor (or equivalent) rate-limiting middleware to the pg-pkg /v2 route scope in pg-pkg/src/server.rs
• apply stricter per-IP limits to POST /start, GET /key, GET /key/{timestamp}, and GET /api-key/validate
• expose the rate limit via Cargo.toml feature or dependency
• add integration tests that verify 429 responses after the limit is exceeded

[dobby-coder]

On it! I'll add actix-governor rate-limiting middleware and integration tests to the postguard service and open a draft PR for review.

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 05 Jul 2026, 05:40 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

Dobby hit a rate limit mid-task and had to pause. Resets 05 Jul 2026, 06:20 CEST. I'll automatically resume where I left off — no work lost!

[dobby-coder]

Fixed a real issue on this one, not just rubber-stamping: cycle 1 had missed that the draft security advisory ID and exploit-class details were named across the PR body, a commit message, and this issue — not great for a public repo. I genericized all three (PR body, rebased the commit, and cleaned up this issue) and confirmed no trace of the sensitive details remains anywhere.

The actual code is solid — rate limiting is implemented correctly with actix-governor, all the sensitive endpoints are covered, and there are 4 solid integration tests. Left a few non-blocking nits in review #4630746973, and flipped PR #226 to ready for review.