fix: track rate limit hits in metrics

- Added RecordRateLimitHit to MetricsRecorder interface
- Call RecordRateLimitHit when EVENT or REQ is rate limited
- Allows dashboard to show accurate rate limiting statistics
- Previously rate limits were applied but not tracked

2 files changed, 8 insertions, 0 deletions

diff --git a/internal/handler/websocket/handler.go b/internal/handler/websocket/handler.go
index c1b23b8..51288bc 100644
--- a/internal/handler/websocket/handler.go
+++ b/internal/handler/websocket/handler.go
@@ -34,6 +34,7 @@ type MetricsRecorder interface {
         SetActiveSubscriptions(count int)
         RecordRequest(method, status string, duration float64)
         RecordAuthAttempt(success bool)
+        RecordRateLimitHit(authenticated bool)
         RecordBlockedEvent(kind int32)
 }
 
@@ -274,6 +275,9 @@ func (h *Handler) handleEvent(ctx context.Context, conn *websocket.Conn, raw []j
                 }
                 if !h.limiter.Allow(identifier, "EVENT") {
                         status = "rate_limited"
+                        if h.metrics != nil {
+                                h.metrics.RecordRateLimitHit(state.authenticatedPubkey != "")
+                        }
                         h.sendOK(ctx, conn, event.ID, false, "rate-limited: slow down")
                         return nil
                 }
@@ -386,6 +390,9 @@ func (h *Handler) handleReq(ctx context.Context, conn *websocket.Conn, raw []jso
                 }
                 if !h.limiter.Allow(identifier, "REQ") {
                         status = "rate_limited"
+                        if h.metrics != nil {
+                                h.metrics.RecordRateLimitHit(state.authenticatedPubkey != "")
+                        }
                         return fmt.Errorf("rate limit exceeded")
                 }
         }
diff --git a/internal/handler/websocket/handler_test.go b/internal/handler/websocket/handler_test.go
index 604a190..2ef72fd 100644
--- a/internal/handler/websocket/handler_test.go
+++ b/internal/handler/websocket/handler_test.go
@@ -98,6 +98,7 @@ func (m *mockMetrics) RecordRequest(method, status string, duration float64) {
         m.requests[key]++
 }
 func (m *mockMetrics) RecordAuthAttempt(success bool) {}
+func (m *mockMetrics) RecordRateLimitHit(authenticated bool) {}
 func (m *mockMetrics) RecordBlockedEvent(kind int32) {
         m.mu.Lock()
         defer m.mu.Unlock()