feat(server): DISABLE_RATE_LIMITS env replaces NODE_ENV-based bypass

Overloading NODE_ENV='test' to silently disable rate limiting layered a
second meaning onto an env that already gates the test-only seed-peer
route. A dedicated DISABLE_RATE_LIMITS env (envBool semantics, matching
DISABLE_FEDERATION_WORKERS) makes intent explicit, defaults off in
production, and leaves room for tests that need to assert real rate-limit
behaviour to opt back in by simply not setting the var.

packages/server/src/index.ts

@@ -83,10 +83,9 @@ async function main(): Promise<void> {
     max: 200,
     timeWindow: '1 minute',
     keyGenerator: (request) => (request as any).userId || request.ip,
-    // In test environments every request originates from 127.0.0.1, so
-    // per-IP rate limits would exhaust across unrelated tests. Bypass all
-    // rate limiting (both global and per-route) when NODE_ENV=test.
-    allowList: () => process.env.NODE_ENV === 'test',
+    // Test harnesses set DISABLE_RATE_LIMITS=1 to bypass per-IP exhaustion when
+    // many tests share the loopback IP. Default unset; production unchanged.
+    allowList: () => process.env.DISABLE_RATE_LIMITS === '1' || process.env.DISABLE_RATE_LIMITS === 'true',
     errorResponseBuilder: (_request, context) => ({
       statusCode: 429,
       error: 'Too Many Requests',