On-chain rate limiting per funding account to prevent spam ephemeral account creation

[phertyameen]

Location

contracts/ephemeral_account/src/lib.rs

Problem

Nothing at the contract level limits how rapidly a single funding account can create new ephemeral accounts; while bridgelet-sdk may apply its own API-level rate limiting, a contract-level safeguard provides defense-in-depth against abuse that bypasses the application layer (e.g. a direct contract call from a malicious actor not going through the SDK at all).

Acceptance Criteria

• Contract-level throttle evaluated and, if adopted, implemented with a configurable window/limit
• Explicitly does not conflict with legitimate high-volume, well-behaved integrators, calibrated against realistic expected usage
• Documented as a defense-in-depth layer distinct from, not a replacement for, bridgelet-sdk's own rate limiting