custom-webhook-ingest

The per-IP rate limit (enforce_webhook_ingest_ip_rate_limit, shared with routers/webhooks.py's own ingest endpoint — same abuse vector, same Redis-backed fixed-window counter) runs as a route-level dependency, ahead of everything below, so a flood of requests against guessed/invalid source ids gets throttled before spending a DB lookup or a signature check on each one.