Add rate limiting to health and metrics endpoints

[DeFiVC]

What

The /health, /health/live, /health/ready, and /metrics endpoints have no rate limiting, while all other routes use the global rate limit.

Why

• Health endpoints make database, Redis, Horizon, and Soroban RPC calls
• An attacker could spam these endpoints to exhaust resources
• /metrics requires authentication but still makes registry calls

Scope

Add rate limit overrides for health and metrics endpoints.

Acceptance Criteria

• /health and /health/ready have rate limiting (e.g., 30 req/min)
• /health/live has minimal rate limiting (it's lightweight)
• /metrics has rate limiting (e.g., 10 req/min)
• Existing rate limit config is not affected
• Health checks from monitoring tools are not blocked

Technical Context

• File: src/server.ts (lines 99-157)
• Pattern: See src/middleware/rate-limit.ts for authRateLimit and claimRateLimit examples
• Fastify config: Use config: { rateLimit: ... } option on route registration

[okoye-collins]

Hey, Maintainer

I will take up this issue. I'm a full-stack engineer,
and I will be willing to handle 80% of the issue in this repo.
I will delivery within 3hours