fix(api): raise admin rate limit and skip throttle on /admin/p

Admin price polling was hitting the shared 60/min IP limit and returning 429 on restore-all.

Co-authored-by: Cursor <cursoragent@cursor.com>

app/Providers/RouteServiceProvider.php

@@ -74,7 +74,21 @@ class RouteServiceProvider extends ServiceProvider
     protected function configureRateLimiting()
     {
         RateLimiter::for('api', function (Request $request) {
-            return Limit::perMinute(60)->by(optional($request->user())->id ?: $request->ip());
+            // throttle قبل از auth اجرا می‌شود → اغلب فقط IP داریم.
+            // پنل ادمین با polling قیمت (/admin/p) + اکشن سریع به‌راحتی از ۶۰/دقیقه رد می‌شود → ۴۲۹.
+            if ($request->is('admin/*')) {
+                return Limit::perMinute(600)->by('admin:'.$request->ip());
+            }
+
+            $userId = optional($request->user())->id
+                ?? optional($request->user('customer'))->id
+                ?? optional($request->user('user'))->id;
+
+            if ($userId) {
+                return Limit::perMinute(180)->by((string) $userId);
+            }
+
+            return Limit::perMinute(60)->by($request->ip());
         });
     }
 }

routes/admin.php

@@ -32,7 +32,8 @@ use App\Services\ConfigService;
 
 Route::middleware('auth:user')->group(function (){
     Route::middleware('validation')->group(function (){
-        Route::get('/p', [PriceController::class, 'methodPrices']);
+        Route::get('/p', [PriceController::class, 'methodPrices'])
+            ->withoutMiddleware(['throttle:api']);
 
         //upload file
         Route::post('/file',[FileController::class, 'store']);