[MuhammadUsamaMX]

Stacked on #2895 (which is stacked on #2879). The diff below is only the last commit; it collapses to 6 files once those merge.

Problem

NVIDIA NIM enforces a per-API-key requests-per-minute limit. Crossing it returns 429, which parks that account on a cooldown — so a short burst can take the whole pool out for minutes even though every account is healthy. The limit is known up front, but nothing counts against it, so it is always discovered by tripping it.

Change

Count our own requests per account and skip an account that has already spent its minute budget, so the request goes to the next account instead of earning a 429.

• src/sse/services/rpmLimiter.js — sliding 60s window per connection id: recordRequest, isOverLimit, retryAfterMs.
• getAuth filters out capped accounts alongside model-locked/excluded ones, and records a request against whichever account it hands out.
• When every account for a provider is capped, it returns the usual allRateLimited shape with the time capacity comes back, rather than failing hard.
• Editable per provider from Providers → [id] (RPM / account, beside Retry delay), stored in settings.rpmByProvider. Blank = DEFAULT_PROVIDER_RPM (40 for nvidia, unset elsewhere), 0 = unlimited.

Counters are in-process. That is the right scope for a single gateway; a multi-instance deployment behind a load balancer would need shared state, and there is a ponytail: note in the file saying so.

Verification

Unit test in tests/unit/rpmLimiter.test.js covers unlimited-when-0, capping at the limit, the window sliding open again, per-account isolation, and retryAfterMs.

End to end against a live instance with 7 NVIDIA accounts, cap temporarily set to 1:

req 1..6 -> 200 ok                     (one account each)
req 7    -> 503 Local 1 RPM cap reached for every nvidia account (reset after 30s)
req 8,9  -> 503 (same)

Log line: [AUTH] nvidia | all 7 accounts at the 1 RPM cap (30s). No 429 was sent upstream. After the window elapsed, requests succeeded again, and with the override removed the default of 40 applies.