Remove chat rate limit

apps/web/middleware.ts

@@ -4,11 +4,9 @@ import type { NextRequest } from "next/server";
 /**
  * Rate limiting for the public API surface.
  *
- * `/api/chat` is reachable by anyone on the internet, takes no credentials,
- * and spends AWS Bedrock credit on every call (understanding + generation +
- * entailment, several model calls per turn) against a small personal budget.
  * The architecture assigns rate limiting to `api-gateway`, which is not built
- * yet, so until it exists this is the only place the limit can live.
+ * yet, so until it exists this is where limits for the remaining bounded API
+ * routes live. `/api/chat` is intentionally unlimited.
  *
  * It runs here rather than inside the route handlers because the edge
  * middleware rejects an abusive request before any handler work — and because
@@ -37,18 +35,9 @@ interface Rule {
   max: number;
 }
 
-// Chat is the expensive path: several Bedrock calls per request, and a single
-// turn was measured taking up to ~45s of model time. Autocomplete is a local
-// catalog lookup with no model call, so it can be far more generous without
-// costing anything.
+// `/api/chat` is intentionally absent, so chat requests pass through without
+// rate limiting. Autocomplete is a local catalog lookup with no model call.
 const RULES: Array<{ prefix: string; rules: Rule[] }> = [
-  {
-    prefix: "/api/chat",
-    rules: [
-      { windowMs: 60_000, max: 12 },
-      { windowMs: 3_600_000, max: 120 },
-    ],
-  },
   {
     prefix: "/api/suggest",
     rules: [{ windowMs: 60_000, max: 120 }],