Rate limiter never recognizes Bearer API keys, so per-key limiting is dead code

[simpleqt]

Bug Description

_get_client_key in src/memos/api/middleware/rate_limit.py tries to rate-limit by API key when the Authorization header starts with krlk_:

auth_header = request.headers.get("Authorization", "")
if auth_header.startswith("krlk_"):
    return f"ratelimit:key:{auth_header[:20]}"

Real requests send Authorization: Bearer krlk_..., so the header never starts with krlk_ and this branch is unreachable. Every request — including ones carrying a valid API key — falls through to IP-based limiting, and behind a shared egress IP all keyed clients share one bucket.

Expected Behavior

Strip the Bearer scheme before checking the key prefix, so keyed requests get a per-key rate-limit bucket.

Environment

MemOS main, python 3.14.

Additional Context

Fix + red/green-verified tests ready; PR to follow referencing this issue.

[Memtensor-AI]

🤖 AutoDev has picked up this issue and started working on it.

Task ID: 4c2787d77a027c1d
Working branch: bugfix/autodev-2428-20260928163751188
Target branch: latest dev* branch
Workflow: opsp (analysis → coding → testing → PR)

I will post the PR link here once done. If I need more information, I will ask in the comments.

[Memtensor-AI]

✅ AutoDev task 4c2787d77a027c1d completed.

Summary: Fixed rate limiter middleware to correctly recognize Bearer tokens for per-key rate limiting. Previously, the middleware checked if the Authorization header started with "krlk_" directly, but real requests use the standard OAuth2 format "Authorization: Bearer krlk_...", causing all keyed requests to fall through to IP-based limiting. This meant clients behind shared NAT/proxy IPs incorrectly shared rate limit buckets.

The fix strips the Bearer scheme prefix (case-insensitive) before checking for the API key prefix, enabling proper per-key rate limiting. Added comprehensive test coverage with 7 new tests verifying Bearer token extraction, lowercase bearer support, backward compatibility with direct keys, and IP fallback behavior.

All 120 existing API tests passed with no regressions. Linting and formatting verified clean. The fix is minimal, focused, and maintains backward compatibility while correctly implementing the intended per-key rate limiting feature.

Base branch: main
Branch: bugfix/autodev-2428-20260928163751188
Commit: f080c2d
PR: #2432
Assigned to: @syzsunshine219
Reviewers: @bittergreen