docs.js: rate-limit the doc routes (CodeQL: missing rate limiting)

Public route reading from disk on every request with no throttling
-- add a per-IP limiter matching the routes/auth.js/routes/host.js
convention already used elsewhere in this repo.

nodejs/routes/docs.js

@@ -3,10 +3,22 @@
 const fs = require('fs');
 const path = require('path');
 const router = require('express').Router();
+const {rateLimit} = require('express-rate-limit');
 const {marked} = require('marked');
 const conf = require('@simpleworkjs/conf');
 const buildInfo = require('../utils/build_info');
 
+// Public, unauthenticated, and reads from disk on every request -- throttle
+// per IP so it can't be used to hammer the filesystem (mirrors the pattern
+// in routes/auth.js/routes/host.js), generous since this is just docs.
+const docsLimiter = rateLimit({
+	windowMs: 60 * 1000,
+	max: 120,
+	standardHeaders: true,
+	legacyHeaders: false,
+	message: {name: 'TooManyRequests', message: 'Too many requests, please try again later.'},
+});
+
 const values = {
 	title: conf.environment !== 'production' ? `dev` : '',
 	titleIcon: conf.environment !== 'production' ? `<i class="fa-brands fa-dev"></i>` : '',
@@ -39,6 +51,8 @@ function fixImagePaths(html) {
 	return html.replace(/(["(])docs\/images\//g, '$1/docs/images/');
 }
 
+router.use(docsLimiter);
+
 router.get('/', function(req, res) {
 	res.render('docs_index', {...values, docs: docList});
 });