Extract shared createRateLimiter factory

[Peolite001]

Description

This PR addresses issue #1099 by extracting a shared createRateLimiter(options) factory. This consolidates the standard rate limiter configuration into a single location so that both globalRateLimiter and streamCreationRateLimiter use a uniform setup. This prevents duplication and ensures any future bug fixes or config updates (such as a Redis store setup or IP-keying fixes) will apply consistently to all rate limiters without needing manual syncing across multiple files.

Type of Change

• 🐛 Bug fix (non-breaking change which fixes an issue)
• ✨ New feature (non-breaking change which adds functionality)
• 💥 Breaking change (fix or feature that would cause existing functionality to not work as expected)
• 📚 Documentation update
• 🔧 Refactoring (no functional changes)
• ⚡ Performance improvement
• 🧪 Test addition or update

Related Issues

Closes #1099

Changes Made

• Created a createRateLimiter(options) factory in backend/src/middleware/rate-limiter.middleware.ts that includes the shared base config (standardHeaders, legacyHeaders).
• Updated globalRateLimiter to utilize this new factory instead of a raw rateLimit() call.
• Imported and utilized createRateLimiter in backend/src/middleware/stream-rate-limiter.middleware.ts for the createStreamRateLimiter factory.

Testing

Test Coverage

• Unit tests added/updated
• Integration tests added/updated
• Manual testing performed

Test Steps

1. Run the existing rate-limiter tests to ensure they still pass successfully with the refactored middleware implementation.
2. Verify normal application usage, confirming that rate limit headers are still being properly appended and returned to clients.

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published
• I have checked for breaking changes and documented them if applicable

Additional Notes

This PR specifically focuses on the refactoring requested in the issue. Fixing the trust-proxy IP-keying issue itself and switching rate-limit backends are out of scope for this change and will be addressed in separate PRs/issues as tracked.

[ogazboiz]

the factory itself is verified good (both limiter configs preserved exactly, overrides still possible via spread order), but the branch went conflicting after #1161 merged its own copies of the main CI fixes. please rebase onto current main (git fetch origin && git rebase origin/main && git push --force-with-lease), dropping your duplicated copies of those fixes, and this merges. while you are in there, two optional tidy-ups: the stray double blank lines in app.ts and where workerId was removed in soroban-event-worker.ts, and consider moving the admin ipKeyGenerator change to its own PR since it belongs to a different issue. if you want to keep contributing, join us on Telegram: https://t.me/+DOylgFv1jyJlNzM0