CLDSRV-853: Account rate limit config

[tmacro]

This PR:

• Refactors the rate limit config parsing to use joi to allow bucket and account configs to share code.
• Adds account level rate limiting config key

Note for reviewers: This PR is being merged into a feature branch so the code can remain "broken" between PRs as code is refactored without impacting the development/* branches.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 84.14%. Comparing base (0efb995) to head (a09c5af).
✅ All tests successful. No failed tests found.

Additional details and impacted files

Files with missing lines	Coverage Δ
lib/Config.js	79.37% <100.00%> (ø)
lib/api/apiUtils/rateLimit/config.js	100.00% <100.00%> (ø)

... and 1 file with indirect coverage changes

@@                             Coverage Diff                             @@
##           improvement/CLDSRV-869/account_limiting    #6104      +/-   ##
===========================================================================
- Coverage                                    84.17%   84.14%   -0.03%     
===========================================================================
  Files                                          204      204              
  Lines                                        13124    13090      -34     
===========================================================================
- Hits                                         11047    11015      -32     
+ Misses                                        2077     2075       -2     

Flag	Coverage Δ
file-ft-tests	67.76% <57.14%> (+0.14%)	⬆️
kmip-ft-tests	28.23% <57.14%> (+0.04%)	⬆️
mongo-v0-ft-tests	69.03% <57.14%> (+0.17%)	⬆️
mongo-v1-ft-tests	69.00% <57.14%> (+0.12%)	⬆️
multiple-backend	35.30% <57.14%> (+0.06%)	⬆️
sur-tests	35.81% <57.14%> (-0.78%)	⬇️
sur-tests-inflights	37.66% <57.14%> (+0.06%)	⬆️
unit	69.63% <95.23%> (-0.08%)	⬇️
utapi-v2-tests	34.56% <57.14%> (+0.05%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[claude]

- burstCapacity schema (config.js:166) is missing .integer() -- inconsistent with limit and the old validation. Allows fractional burst values.

Review by Claude Code

[claude]

LGTM

Clean refactor from manual assert-based validation to Joi schema. The shared rateLimitClassConfigSchema and transformClassConfig eliminate duplication between bucket and account config parsing. Validation behavior is preserved with improved error reporting (all errors at once via abortEarly: false). Tests are thorough and cover the new account config, unknown field rejection, and multi-error reporting.

Review by Claude Code

[claude]

• burstCapacity validation relaxed from positive integer to positive number (fractional values now accepted). Intentional or missing .integer()?
  • Add .integer() to the Joi schema for burstCapacity if integer constraint was intended
• account config not initialized by default unlike bucket, which may cause issues if a per-account rate limit API is added later
  • Initialize parsed.account with defaults unconditionally, same as bucket

Review by Claude Code

[claude]

• burstCapacity and defaultBurstCapacity in rateLimitClassConfigSchema lost the .integer() constraint during the migration from assert to Joi, allowing non-integer values like 1.5 that were previously rejected.
  - Add .integer() to both: Joi.number().integer().positive()
  - Restore the removed burstCapacity-is-not-an-integer test case
  
  Review by Claude Code

[claude]

LGTM

Review by Claude Code

[claude]

LGTM

Review by Claude Code