- Every public route and its position in the middleware stack
- Existing middleware configuration files and where limits are currently defined
- Auth-specific routes that need a separate, stricter policy
- Any tests covering route behavior that need updating
- Rate limiting middleware wired into the existing middleware chain
- Per-route and per-group limit configuration matching the existing config structure
- Updated auth route handlers with the stricter policy applied
- Test coverage reflecting the new limiting behavior

