fix(node): gate /ipfs/pins and /arweave/anchors behind authentication (#121)

.env.example

@@ -102,6 +102,33 @@ GITLAWB_ENFORCE_OWNER_PUSH=false
 # Example: /ip4/1.2.3.4/udp/7546/quic-v1/p2p/12D3KooW...
 GITLAWB_P2P_BOOTSTRAP=
 
+# ── IPFS pin listing (visibility walk + rate limiting) ────────────────────
+# Maximum concurrent visibility walks (git rev-list / ls-tree) across all
+# IPFS pin listing requests.  Prevents a flood of signed requests from
+# exhausting the blocking-pool worker or leaving git children running past
+# their timeout. Default 4.
+GITLAWB_WALK_CONCURRENCY_LIMIT=4
+
+# Per-DID rate limit — requests per hour per signed DID.  The listing performs
+# Per-DID rate limit — requests per hour per signed DID.  The listing performs
+# expensive git walks and cat-file probes, so a throwaway DID with a valid
+# signature can otherwise exhaust resources. Default 60.
+GITLAWB_IPFS_LIST_RATE_LIMIT=60
+
+# Global (non-sybil) rate limit — total requests per hour regardless of signed
+# DID.  Prevents DID-rotation attacks from bypassing the per-DID limiter.
+# Charged only after the per-DID check passes so a single DID cannot drain the
+# shared bucket with rejected requests. Default 1200.
+GITLAWB_IPFS_LIST_GLOBAL_RATE_LIMIT=1200
+
+# Arweave anchor listing uses its OWN rate-limit buckets so anchor enumeration
+# cannot drain the IPFS pin-listing budget (same shapes, separate state).
+# Per-DID requests per hour. Default 60.
+GITLAWB_ARWEAVE_LIST_RATE_LIMIT=60
+
+# Global (non-sybil) Arweave anchor listing requests per hour. Default 1200.
+GITLAWB_ARWEAVE_LIST_GLOBAL_RATE_LIMIT=1200
+
 # ── Access control ────────────────────────────────────────────────────────
 # Reserved for private-read mode. Public/private repo read enforcement is not
 # wired in the current live release; do not rely on this for private repositories.

crates/gitlawb-node/Cargo.toml

@@ -73,6 +73,9 @@ alloy = { version = "1", default-features = false, features = [
     "rpc-types-eth",
 ] }
 libp2p-dns = { version = "0.44.0", features = ["tokio"] }
+rand = { workspace = true }
+hkdf = "0.12"
+chacha20poly1305 = "0.10"
 
 [dev-dependencies]
 mockito = "1"