feat(server): DISABLE_RATE_LIMITS env replaces NODE_ENV-based bypass

Overloading NODE_ENV='test' to silently disable rate limiting layered a
second meaning onto an env that already gates the test-only seed-peer
route. A dedicated DISABLE_RATE_LIMITS env (envBool semantics, matching
DISABLE_FEDERATION_WORKERS) makes intent explicit, defaults off in
production, and leaves room for tests that need to assert real rate-limit
behaviour to opt back in by simply not setting the var.

docs/systems/federation.md

@@ -1435,6 +1435,10 @@ DM channel hard-delete cascades: reactions, embeds, attachments (DB rows + disk
 
 `POST /api/admin/test/seed-peer` directly inserts a `federation_peers` row, skipping the multi-step peer handshake. Strictly gated: `NODE_ENV='test'` AND `ENABLE_TEST_ROUTES='1'` together; returns 404 in any other configuration. Used exclusively by the two-instance integration harness in `packages/server/test/`. Validates `origin` (must be http(s) URL), `hmacSecret` (≥32 chars), and `status` (must be one of `'active'`, `'pending'`, `'awaiting_approval'`, `'rejected'`, `'revoked'`, `'needs_attention'`, `'unreachable'`, `'accepted'`).
 
+### Rate-limit bypass (test only)
+
+`DISABLE_RATE_LIMITS=1` bypasses all `@fastify/rate-limit` enforcement at boot (envBool semantics: `'1'` or `'true'`). Used by integration test harnesses where many tests share the loopback IP and would otherwise exhaust per-IP buckets across unrelated tests. Defaults to enforced rate limits in production. The two-instance harness sets this in every spawned instance's env; tests that need to assert rate-limit behaviour (e.g. Test #15) use `bootTwoInstancesWithRateLimits()` which omits the env var.
+
 ---
 
 ## 15. Settings Cache

packages/server/src/index.ts

@@ -83,10 +83,9 @@ async function main(): Promise<void> {
     max: 200,
     timeWindow: '1 minute',
     keyGenerator: (request) => (request as any).userId || request.ip,
-    // In test environments every request originates from 127.0.0.1, so
+    // Test harnesses set DISABLE_RATE_LIMITS=1 to bypass per-IP exhaustion when
-    // per-IP rate limits would exhaust across unrelated tests. Bypass all
+    // many tests share the loopback IP. Default unset; production unchanged.
-    // rate limiting (both global and per-route) when NODE_ENV=test.
+    allowList: () => process.env.DISABLE_RATE_LIMITS === '1' || process.env.DISABLE_RATE_LIMITS === 'true',
-    allowList: () => process.env.NODE_ENV === 'test',
     errorResponseBuilder: (_request, context) => ({
       statusCode: 429,
       error: 'Too Many Requests',