harden Tinybird JWT limits and cache

[Makisuo]

Summary

• add opt-in, per-org Tinybird JWT RPS limits
• fail fast on partial JWT signing config and warn when runtime/admin tokens are shared
• bound the per-isolate JWT cache with expiration and LRU eviction
• document and deploy the new optional setting

Why

Tinybird rate limits are grouped by JWT name, so a shared name would let one org consume the entire allowance. The existing token cache was also unbounded, and partial signing configuration only failed on first use.

Impact

No auth or warehouse-routing changes. RPS limiting remains disabled unless TINYBIRD_RAW_SQL_JWT_RPS_LIMIT is configured.

Validation

• 46 focused Vitest tests
• bun run --cwd apps/api typecheck
• bunx tsc --noEmit -p tsconfig.alchemy.json
• Oxlint on changed TypeScript files

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

🍁 Maple PR preview

Note

Preview resources were removed when this pull request closed.

Final commit 132d875 · View workflow run