Rate limit pairing by deploy pubkey, not only by IP

[blockchain-maxis]

IP-based limiting does not stop an attacker who rotates addresses from probing which deploy accounts are already linked, or from grinding approvals against many candidate accounts.

Why it matters: the completion endpoint's error messages necessarily distinguish "already linked to another profile" from "not linked" (see the anti-hijack issue), which is an enumeration oracle if it can be called freely.

Acceptance: a per-deploy-pubkey limit applies in addition to the per-IP limit on cli:pair:complete; exceeding it fails closed; covered by a test.

[chidumebiodoh123-cloud]

@chidumebiodoh123-cloud has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hello Maintainer, I’ve looked through the issue and have a clear understanding of what needs to be done. I’d be glad to take it on and work toward a proper solution

ℹ️ Repo Maintainers: To accept this application, review their application or assign @chidumebiodoh123-cloud to this issue.

[Anambraboi-1]

@Anambraboi-1 has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Understanding: cli:pair:complete distinguishes "already linked to another profile" from "not linked" in its error responses (needed for the anti-hijack behavior), which makes it an enumeration oracle — an attacker who rotates IPs can grind through candidate deploy pubkeys and use those distinct error messages to map out which accounts are already linked. IP-based rate limiting alone doesn't stop this since IP rotation sidesteps it entirely; the limit needs to also key on the deploy pubkey being probed, independent of the caller's IP.

Approach:

Add a second rate-limit bucket keyed on the deploy pubkey being checked/paired, applied in addition to (not instead of) the existing per-IP limit on cli:pair:complete.
Ensure the pubkey-keyed limit triggers regardless of which IP the request comes from, so rotating IPs doesn't reset it.
Fail closed when either limit (IP or pubkey) is exceeded — reject the request rather than falling back to unlimited.
Keep the error response shape unchanged for legitimate rate-limit rejections (distinct from the "already linked"/"not linked" messages, so the rate-limit itself doesn't become a new oracle).

Verification plan:

Test: repeated cli:pair:complete calls against the same deploy pubkey from different IPs still trip the pubkey-keyed limit.
Test: calls against different pubkeys from the same IP still trip the existing per-IP limit independently.
Test: exceeding either limit fails closed with a consistent rejection (not a distinguishable error that leaks new info).
Regression test: legitimate single-attempt pairing still succeeds normally under both limits.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Anambraboi-1 to this issue.

[yustech-alt]

@yustech-alt has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Hi Maintainer, I’d like to work on this issue. I have experience handling similar tasks and can start immediately.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @yustech-alt to this issue.

[OmniZlatoon]

@OmniZlatoon has applied to work on this issue as part of the Stellar Wave Program's 8th wave.

Sir please assign me your issues. I am desperate to work but issues are scarce. my Eta is 5 hours max.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @OmniZlatoon to this issue.

[drips-wave]

Congratulations, @Anambraboi-1! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on August 31, 2026.

🧑‍💻 @Anambraboi-1: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊