Add user agent blocklist, use X-Real-IP header for IP detection

backend/app.py

@@ -14,6 +14,8 @@ from utils import get_client_ip
 from db import POOL_CONFIG, SessionLocal
 from logging_config import access_logger  # noqa: F401 - ensure loggers configured
 from security.audit import log_access
+from security.rate_limit import limiter
+from slowapi.middleware import SlowAPIMiddleware
 
 logger = logging.getLogger("uvicorn.error")
 
@@ -73,6 +75,10 @@ async def lifespan(app: FastAPI):
 # Инициализация FastAPI
 app = FastAPI(title="FromChat", lifespan=lifespan)
 
+# Add rate limiting middleware
+app.state.limiter = limiter
+app.add_middleware(SlowAPIMiddleware)
+
 
 @app.middleware("http")
 async def access_logging_middleware(request: Request, call_next):