fix(api): scope 429 OpenAPI injection to rate-limited routes

Previous commit advertised 429 on every operation. Only routes
decorated with @limiter.limit can actually return slowapi's 429 —
currently just POST /api/v1/auth/login. Documenting it elsewhere is
dishonest and would mislead clients into expecting a response the
server cannot produce.

Walk slowapi's _route_limits / _dynamic_route_limits registries to
identify decorated endpoints, match them to FastAPI routes by
{module}.{name}, and only inject 429 on those.

Existing per-route 429 declarations (e.g. SSE connection-cap on
events streams via sse_limits) are untouched.

decnet/web/api.py

@@ -258,15 +258,32 @@ if DECNET_PROFILE_REQUESTS:
 app.include_router(api_router, prefix="/api/v1")
 
 
-def _custom_openapi() -> dict:
-    """Inject the global 429 response into every operation.
+def _rate_limited_endpoint_names() -> set[str]:
+    """Return ``{module}.{qualname}`` for every endpoint slowapi tracks.
 
-    SlowAPI middleware can short-circuit any request with 429 once the
-    per-route or per-IP rate limit fires, so the OpenAPI spec must
-    advertise 429 on every operation — otherwise schemathesis flags
-    legitimate rate-limit responses as schema-noncompliant.
+    slowapi tags each ``@limiter.limit(...)``-decorated function under
+    these two registries. We do NOT advertise 429 on undecorated routes:
+    SlowAPIMiddleware only consults the registries, so an endpoint
+    without a decorator can never legitimately return 429, and
+    documenting it would mislead clients.
+    """
+    names: set[str] = set()
+    names.update(getattr(limiter, "_route_limits", {}).keys())
+    names.update(getattr(limiter, "_dynamic_route_limits", {}).keys())
+    return names
+
+
+def _custom_openapi() -> dict:
+    """Inject 429 into the OpenAPI spec for rate-limited operations only.
+
+    SlowAPI returns 429 from ``@limiter.limit(...)``-decorated routes
+    (currently just ``POST /api/v1/auth/login``). Without 429 in the
+    spec, schemathesis flags legitimate rate-limit responses as
+    status-code-nonconformant. We restrict the injection to actually
+    rate-limited endpoints so the spec stays honest.
     """
     from fastapi.openapi.utils import get_openapi
+    from fastapi.routing import APIRoute
 
     if app.openapi_schema:
         return app.openapi_schema
@@ -276,6 +293,12 @@ def _custom_openapi() -> dict:
         routes=app.routes,
         description=app.description,
     )
+
+    rate_limited = _rate_limited_endpoint_names()
+    if not rate_limited:
+        app.openapi_schema = schema
+        return schema
+
     too_many = {
         "description": "Rate limit exceeded",
         "content": {
@@ -288,13 +311,29 @@ def _custom_openapi() -> dict:
             }
         },
     }
-    for path_item in schema.get("paths", {}).values():
+
+    # Build {(path, method): endpoint_qualname} from the live route table.
+    route_index: dict[tuple[str, str], str] = {}
+    for route in app.routes:
+        if not isinstance(route, APIRoute):
+            continue
+        endpoint = route.endpoint
+        # slowapi unwraps decorated functions but keeps the original
+        # __module__/__name__ via functools.wraps, so this matches.
+        qualname = f"{endpoint.__module__}.{endpoint.__name__}"
+        for method in route.methods or ():
+            route_index[(route.path, method.lower())] = qualname
+
+    for path, path_item in schema.get("paths", {}).items():
         for method, op in path_item.items():
             if method.lower() not in {
                 "get", "post", "put", "patch", "delete", "options", "head",
             }:
                 continue
-            op.setdefault("responses", {}).setdefault("429", too_many)
+            qualname = route_index.get((path, method.lower()))
+            if qualname and qualname in rate_limited:
+                op.setdefault("responses", {}).setdefault("429", too_many)
+
     app.openapi_schema = schema
     return schema