Add rate limit headers to API responses #548

Summary: Clients are not informed about current rate limit status leading to surprise 429s.

• Context: Standard headers like X-RateLimit-* improve client behavior and UX.
• Expected: Include headers exposing limit, remaining, and reset time on responses.
• Suggested fix: Enhance rate limiting middleware to set headers on all relevant responses.
• Notes: Document headers in API docs and ensure consistency across routes.