No rate limiting on auth or paid API routes in Vercel

Vercel documents a firewall in front of deployments. Which rules are included on which plan changes, so check the current Vercel docs before you rely on it as the only limit. A firewall rule is still worth having for obvious floods. Keep a limit in the handler for the routes that cost money per call, because a firewall does not know that this POST triggers a model.