feat: harden phase 3 api security

apps/api/views.py

@@ -24,6 +24,7 @@ from apps.api.serializers import (
     RechargeCreateRequestSerializer,
     RechargeStatusRequestSerializer,
 )
+from apps.api.throttles import GenerateRateThrottle, throttle_api_auth_failure
 from apps.billing.models import RechargeOrder
 from apps.billing.payment_gateways import (
     PaymentOrderCreateError,
@@ -56,11 +57,14 @@ class ExternalApiView(APIView):
 
     def permission_denied(self, request, message=None, code=None):
         if request.authenticators and not request.successful_authenticator:
+            throttle_api_auth_failure(request)
             raise AuthenticationFailed(api_error("unauthorized", "缺失或无效 API Key"))
         super().permission_denied(request, message=message, code=code)
 
 
 class GenerateTitleView(ExternalApiView):
+    throttle_classes = (GenerateRateThrottle,)
+
     def post(self, request):
         serializer = GenerateTitleRequestSerializer(data=request.data)
         if not serializer.is_valid():
@@ -80,6 +84,8 @@ class GenerateTitleView(ExternalApiView):
 
 
 class GenerateImageView(ExternalApiView):
+    throttle_classes = (GenerateRateThrottle,)
+
     def post(self, request):
         serializer = GenerateImageRequestSerializer(data=request.data)
         if not serializer.is_valid():