fix various bugs

[zedimytch]

• Reject API keys for inactive marketplaces during key validation, so marketplace suspension actually blocks authenticated API access.
• Add a 1,000-item max batch size for reversal creation and reject empty reversal batches before DB work.
• Add per-marketplace in-memory rate limiting for reversal and marketplace key routes, preventing quota bypass by rotating API keys.

---

Note

Medium Risk
Changes auth validation and rate-limit identity for production API routes; inactive-marketplace behavior may surprise integrators who still hold valid keys.

Overview
Tightens marketplace lifecycle and API access so suspension and platform rules actually stick at runtime.

Admin PATCH now returns 403 when trying to set is_active: false on the csfloat marketplace (mirroring existing delete protection), with no DB update or audit record.

Authentication rejects valid API keys when the linked marketplace is inactive (ValidateKey treats that like record not found), so deactivation blocks authenticated traffic.

Reversal ingestion rejects empty data arrays and batches over 1,000 items before any DB work.

Rate limiting on marketplace key management and reversal routes switches from per API key to per marketplace slug (ThrottleByMarketplace), so rotating keys cannot bypass shared quotas.

^{Reviewed by Cursor Bugbot for commit 03abd89. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit a1f20f2. Configure here.}