added rate-limiting for specific requests

api/README.md

@@ -55,6 +55,18 @@ an env var nor a matching crontab line is found, you just get the
 last-scrape info with `next_scrape_at` / `seconds_until_next_scrape` as
 `null`.
 
+### `/reload` rate limiting
+
+`POST /reload` is limited to one call per `RELOAD_MIN_INTERVAL_SECONDS`
+(default 10) - a call within that window returns `429` with a `Retry-After`
+header instead of re-reading the file(s). This is a single shared cooldown,
+not per-caller, so it also protects the server if several callers hit it at
+once.
+
+```bash
+RELOAD_MIN_INTERVAL_SECONDS=30 uvicorn main:app
+```
+
 ## Endpoints
 
 | Method | Path              | Description |
@@ -65,7 +77,7 @@ last-scrape info with `next_scrape_at` / `seconds_until_next_scrape` as
 | GET    | `/events/{index}` | Single event by its position in the merged list (0-based) |
 | GET    | `/artists`        | Deduplicated, sorted list of all artist names |
 | GET    | `/calendar.ics`   | iCalendar/webcal feed of all events — subscribe with `webcal://<host>/calendar.ics` |
-| POST   | `/reload`         | Re-read the data file(s) from disk (after a fresh scrape) |
+| POST   | `/reload`         | Re-read the data file(s) from disk (after a fresh scrape) - rate-limited, see below |
 
 ### `/events` query parameters