71fffdd2b9
## Description The widget conversation transcript endpoint (`POST /api/v1/widget/conversations/transcript`) has no rate limit. Every other comparable endpoint does: the agent-facing transcript API and the widget conversation-create and contact-update endpoints are all throttled. This gap lets a single client trigger a large burst of transcript emails from one conversation. This adds an IP-based throttle (5 requests/hour) for the endpoint, placed inside the existing widget-API throttle block so it inherits the `ENABLE_RACK_ATTACK_WIDGET_API` opt-out used by embedded/iframe clients. The limit is generous for legitimate use (a visitor emailing themselves a transcript) while stopping abusive loops. Throttled requests get the standard 429 the widget already handles. ## Type of change - [x] Bug fix (non-breaking change which fixes an issue) ## How Has This Been Tested? `config/initializers/rack_attack.rb` throttles have no existing specs in this file, so this follows the established convention (no new spec). Verified `ruby -c` and `rubocop` pass on the file. The new throttle mirrors the sibling widget throttles directly above it (same IP key, path guard, and structure). ## Checklist: - [x] My code follows the style guidelines of this project - [x] I have performed a self-review of my code - [x] My changes generate no new warnings --------- Co-authored-by: Sojan Jose <sojan@pepalo.com>