Apply existing rate limiting to scratch read routes.

Reuse the current IP-based limiter for read endpoints so public reads remain open but throttled, and add integration coverage plus docs updates for the expanded scope.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/http/handlers_integration_test.go

@@ -151,6 +151,50 @@ func TestUploadedScratchViewAndRawBeforeAndAfterExpiry(t *testing.T) {
 	}
 }
 
+func TestReadRoutesAreRateLimitedWhenEnabled(t *testing.T) {
+	t.Parallel()
+
+	handler := newTestHandler(t, testServerOptions{
+		maxUploadBytes:  1024,
+		defaultTTL:      time.Hour,
+		rateLimitEnable: true,
+	})
+
+	createReq := httptest.NewRequest(http.MethodPost, "/api/scratch", bytes.NewBufferString("hello scratch"))
+	createReq.Header.Set("Content-Type", "text/plain; charset=utf-8")
+	createReq.RemoteAddr = "127.0.0.1:9111"
+	createRec := httptest.NewRecorder()
+	handler.ServeHTTP(createRec, createReq)
+	if createRec.Code != http.StatusCreated {
+		t.Fatalf("create status = %d, want %d", createRec.Code, http.StatusCreated)
+	}
+
+	var payload map[string]any
+	if err := json.Unmarshal(createRec.Body.Bytes(), &payload); err != nil {
+		t.Fatalf("decode create payload error = %v", err)
+	}
+	id, _ := payload["id"].(string)
+	if id == "" {
+		t.Fatalf("create payload missing id")
+	}
+
+	firstRawReq := httptest.NewRequest(http.MethodGet, "/api/raw/"+id, nil)
+	firstRawReq.RemoteAddr = "127.0.0.1:9111"
+	firstRawRec := httptest.NewRecorder()
+	handler.ServeHTTP(firstRawRec, firstRawReq)
+	if firstRawRec.Code != http.StatusOK {
+		t.Fatalf("first raw status = %d, want %d", firstRawRec.Code, http.StatusOK)
+	}
+
+	secondRawReq := httptest.NewRequest(http.MethodGet, "/api/raw/"+id, nil)
+	secondRawReq.RemoteAddr = "127.0.0.1:9111"
+	secondRawRec := httptest.NewRecorder()
+	handler.ServeHTTP(secondRawRec, secondRawReq)
+	if secondRawRec.Code != http.StatusTooManyRequests {
+		t.Fatalf("second raw status = %d, want %d", secondRawRec.Code, http.StatusTooManyRequests)
+	}
+}
+
 func TestCreateScratchRejectsBodyOverLimit(t *testing.T) {
 	t.Parallel()