refactor: form-core wiring, JWT sessions, slowapi, packaging, frontend rewrite, test declutter

backend/app/main.py

@@ -4,13 +4,16 @@ from collections.abc import AsyncIterator
 from contextlib import asynccontextmanager
 from pathlib import Path
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse
+from slowapi.errors import RateLimitExceeded
+from slowapi.middleware import SlowAPIMiddleware
 from starlette.middleware.body_limit import RequestBodyLimitMiddleware
 
 from .auth.api import access_router, auth_router
-from .flows.api import approvals_router, flows_router
+from .flows.api import approvals_router, flows_router, runs_router
 from .flows.sync import format_report, run_sync_blocking, watch_forever
-from .middleware import RunThrottleMiddleware, SecurityHeadersMiddleware
+from .middleware import SecurityHeadersMiddleware, limiter
 from .settings import settings
 
 logger = logging.getLogger(__name__)
@@ -64,12 +67,23 @@ app = FastAPI(
 # entrypoint.sh) trusts its forwarding headers so Secure cookies, client
 # IPs (throttle) and absolute URLs are correct. The API is not directly
 # internet-reachable (proxy-only), so trusting them is safe.
+app.state.limiter = limiter
 app.add_middleware(RequestBodyLimitMiddleware, max_body_size=settings.max_body_bytes)
-app.add_middleware(RunThrottleMiddleware)
+app.add_middleware(SlowAPIMiddleware)
 app.add_middleware(SecurityHeadersMiddleware)
 
+
+@app.exception_handler(RateLimitExceeded)
+async def _throttle_handler(request: Request, exc: RateLimitExceeded) -> JSONResponse:
+    response = JSONResponse({"detail": "too many runs, try again later"}, status_code=429)
+    retry_after = getattr(exc, "retry_after", None) or "60"
+    response.headers["Retry-After"] = str(retry_after)
+    return response
+
+
 app.include_router(flows_router)
 app.include_router(approvals_router)
+app.include_router(runs_router)
 app.include_router(access_router)
 app.include_router(auth_router)