Add request rate limiting for recipe API calls

[jess-ve]

Summary\nAdd server-side request rate limiting around outbound recipe API calls (Spoonacular) to protect quotas before beta.\n\n## Why\n- Prevent overages once usage exceeds dev volumes\n- Enforce fairness across concurrent users\n- Provide clear 429 handling for the mobile app and voice flows\n\n## Scope\n- Apply a configurable per-IP and/or global rate limit for recipe search and detail calls\n- Return meaningful error payload when limited\n- Add configuration flags for limits (env-driven)\n- Include tests covering allowed/blocked paths\n\n## Out of scope (for this issue)\n- Response caching (tracked separately)\n- Changing provider choice\n\n## Acceptance Criteria\n- Rate limiting enabled and configurable\n- 429 responses include actionable message\n- Unit tests cover limit + non-limit paths\n- Docs updated to describe configuration