- Apply restrictive rate limits (10 req/min) to prevent brute-force attacks - Log requests with path and client IP for monitoring and debugging - Extract client IP handling for proxy setups (X-Forwarded-For) - Add comprehensive tests for rate limiting and logging behavior Refs #338 Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>