Public JSON API with OpenAPI, etags and rate limits #20

Why

Other tools should be able to build on the data without scraping or hammering the API.

In this repo today

FastAPI serves the routes in routes.py under /api, with /api/health and /api/window in main.py. CORS comes from cors_origins in config.py. The only rate limiting is on chat (chat/ratelimit.py, 10 per minute and 50 per hour per IP). FastAPI also generates an OpenAPI document; check the path and link it from the README.

What to build

• Middleware that adds an ETag and Cache-Control: public, max-age=300 to every GET and answers If-None-Match with 304.
• A per IP limit of 60 requests per minute on all GET routes, returning 429 with a Retry-After, built on the chat limiter and covered by tests in tests/test_ratelimit.py.
• /api/health also reports when the data was last generated and the git sha (from a GIT_SHA environment variable set by the Docker build).
• A static /status page in the web app that polls the health route.
• docs/deploy.md covering Railway (the current deploy, see railway.json and the Dockerfile) and fly.io.

Acceptance criteria

• curl -I shows an ETag, and a second request with If-None-Match returns 304.
• The 61st request in a minute from one IP returns 429.

See CONTRIBUTING.md for conventions.