feat(ratelimit): Add annotation-based rate limiting with Redis ZSET tracking

- Introduce `@RateLimit` annotation for per-endpoint request limits
- Create `RateLimitService` using Redis ZSET for sliding-window rate limiting
- Apply `@RateLimit` on endpoints
- Define `TooManyRequestsException` and related exception handler

Author: gymynnym

src/main/kotlin/me/loghub/api/aspect/common/RateLimitAspect.kt

@@ -0,0 +1,41 @@
+package me.loghub.api.aspect.common
+
+import me.loghub.api.entity.user.User
+import me.loghub.api.exception.common.TooManyRequestsException
+import me.loghub.api.lib.ratelimit.RateLimit
+import me.loghub.api.service.common.RateLimitService
+import org.aspectj.lang.JoinPoint
+import org.aspectj.lang.annotation.Aspect
+import org.aspectj.lang.annotation.Before
+import org.aspectj.lang.reflect.MethodSignature
+import org.springframework.security.core.context.SecurityContextHolder
+import org.springframework.stereotype.Component
+
+@Aspect
+@Component
+class RateLimitAspect(private val rateLimitService: RateLimitService) {
+    @Before("@annotation(rateLimit)")
+    fun checkRateLimit(joinPoint: JoinPoint, rateLimit: RateLimit) {
+        val authentication = SecurityContextHolder.getContext().authentication
+            ?: throw IllegalStateException("No authentication found")
+
+        val principal = authentication.principal as? User
+            ?: throw IllegalStateException("Principal is not User")
+
+        val methodSignature = joinPoint.signature as MethodSignature
+        val method = methodSignature.method
+
+        val allowed = rateLimitService.tryConsume(
+            userId = principal.id!!,
+            className = method.declaringClass.name,
+            methodName = method.name,
+            limit = rateLimit.limit,
+            window = rateLimit.window,
+            unit = rateLimit.unit
+        )
+
+        if (!allowed) {
+            throw TooManyRequestsException()
+        }
+    }
+}

src/main/kotlin/me/loghub/api/constant/message/ResponseMessage.kt

@@ -11,6 +11,7 @@ object ResponseMessage {
         const val CONFLICT = "요청이 현재 상태와 충돌합니다."
         const val CONFLICT_FIELD = "필드 값이 충돌합니다."
         const val MISSING_COOKIE = "쿠키가 전달되지 않았습니다."
+        const val TOO_MANY_REQUESTS = "너무 많은 요청이 발생했습니다. 잠시 후 다시 시도해주세요."
         const val COOLDOWN_NOT_ELAPSED = "쿨타임이 지나지 않았습니다."
         const val INTERNAL_SERVER_ERROR = "알 수 없는 문제가 발생했습니다. 잠시 후 다시 시도해주세요."
     }

src/main/kotlin/me/loghub/api/controller/user/UserController.kt

@@ -7,12 +7,14 @@ import me.loghub.api.dto.response.ResponseBody
 import me.loghub.api.dto.user.UpdateUsernameDTO
 import me.loghub.api.dto.user.UserDetailDTO
 import me.loghub.api.entity.user.User
+import me.loghub.api.lib.ratelimit.RateLimit
 import me.loghub.api.service.user.UserService
 import org.springframework.http.HttpStatus
 import org.springframework.http.ResponseEntity
 import org.springframework.security.core.annotation.AuthenticationPrincipal
 import org.springframework.web.bind.annotation.*
 import org.springframework.web.multipart.MultipartFile
+import java.time.temporal.ChronoUnit
 
 @RestController
 @RequestMapping("/users")
@@ -24,6 +26,7 @@ class UserController(private val userService: UserService) {
     }
 
     @PutMapping("/username")
+    @RateLimit(limit = 3, window = 8, unit = ChronoUnit.HOURS)
     fun updateUsername(
         @RequestBody @Valid requestBody: UpdateUsernameDTO,
         @AuthenticationPrincipal user: User
@@ -36,6 +39,7 @@ class UserController(private val userService: UserService) {
     }
 
     @PutMapping("/avatar")
+    @RateLimit(limit = 5, window = 1, unit = ChronoUnit.HOURS)
     fun updateAvatar(
         @RequestPart("file") file: MultipartFile,
         @AuthenticationPrincipal user: User,

src/main/kotlin/me/loghub/api/controller/user/UserImageController.kt

@@ -3,6 +3,7 @@ package me.loghub.api.controller.user
 import me.loghub.api.dto.response.DataResponseBody
 import me.loghub.api.dto.response.ResponseBody
 import me.loghub.api.entity.user.User
+import me.loghub.api.lib.ratelimit.RateLimit
 import me.loghub.api.service.user.UserImageService
 import org.springframework.http.HttpStatus
 import org.springframework.http.ResponseEntity
@@ -12,11 +13,13 @@ import org.springframework.web.bind.annotation.RequestMapping
 import org.springframework.web.bind.annotation.RequestPart
 import org.springframework.web.bind.annotation.RestController
 import org.springframework.web.multipart.MultipartFile
+import java.time.temporal.ChronoUnit
 
 @RestController
 @RequestMapping("/users/image")
 class UserImageController(private val userImageService: UserImageService) {
     @PostMapping("/upload")
+    @RateLimit(limit = 10, window = 1, unit = ChronoUnit.HOURS)
     fun uploadImage(
         @RequestPart("file") file: MultipartFile,
         @AuthenticationPrincipal user: User,

…e/loghub/api/exception/FieldException.kt …b/api/exception/common/FieldException.ktsrc/main/kotlin/me/loghub/api/exception/FieldException.kt renamed to src/main/kotlin/me/loghub/api/exception/common/FieldException.kt src/main/kotlin/me/loghub/api/exception/FieldException.kt renamed to src/main/kotlin/me/loghub/api/exception/common/FieldException.kt

@@ -1,4 +1,4 @@
-package me.loghub.api.exception
+package me.loghub.api.exception.common
 
 open class FieldException(
     val field: String,

src/main/kotlin/me/loghub/api/exception/common/TooManyRequestsException.kt

@@ -0,0 +1,7 @@
+package me.loghub.api.exception.common
+
+import me.loghub.api.constant.message.ResponseMessage
+
+class TooManyRequestsException(
+    override val message: String = ResponseMessage.Default.TOO_MANY_REQUESTS
+) : RuntimeException(message)

src/main/kotlin/me/loghub/api/exception/entity/EntityExistsFieldException.kt

@@ -1,7 +1,7 @@
 package me.loghub.api.exception.entity
 
 import me.loghub.api.constant.message.ResponseMessage
-import me.loghub.api.exception.FieldException
+import me.loghub.api.exception.common.FieldException
 
 class EntityExistsFieldException(
     field: String,

src/main/kotlin/me/loghub/api/exception/entity/EntityNotFoundFieldException.kt

@@ -1,7 +1,7 @@
 package me.loghub.api.exception.entity
 
 import me.loghub.api.constant.message.ResponseMessage
-import me.loghub.api.exception.FieldException
+import me.loghub.api.exception.common.FieldException
 
 class EntityNotFoundFieldException(
     field: String,

src/main/kotlin/me/loghub/api/exception/validation/ConflictFieldException.kt

@@ -1,7 +1,7 @@
 package me.loghub.api.exception.validation
 
 import me.loghub.api.constant.message.ResponseMessage
-import me.loghub.api.exception.FieldException
+import me.loghub.api.exception.common.FieldException
 
 class ConflictFieldException(
     field: String,

src/main/kotlin/me/loghub/api/exception/validation/IllegalFieldException.kt

@@ -1,7 +1,7 @@
 package me.loghub.api.exception.validation
 
 import me.loghub.api.constant.message.ResponseMessage
-import me.loghub.api.exception.FieldException
+import me.loghub.api.exception.common.FieldException
 
 class IllegalFieldException(
     field: String,