DDoS

Per-client limits are not enough when a distributed flood consumes all available request capacity.

Add global in-flight request load shedding.

1. Implement and export function createLoadShedder(options: LoadSheddingOptions): RequestHandler in src/security/loadShedding.ts.
2. Validate options with the prebuilt validateLoadSheddingOptions helper.
3. Create a closure to count the number of in-flight requests.
4. Return a request handler:
   1. Set X-In-Flight-Limit to the configured maxConcurrent value.
   2. If the cap has already been reached, call the prebuilt rejectLoadShedding helper and return.
   3. Otherwise, count the request as in flight.
   4. Release an in-flight request's capacity once its response finishes or its connection closes.
   5. Ensure each request releases capacity only once, even if both events fire.
   6. Call the next handler.
5. In src/app.ts, create a global load shedder named loadShedder with a 50 request cap and a 1 second retry delay.
6. Mount it after the existing /health but before the global rate limiter.
7. Start the app.

This is graceful degradation, not complete DDoS protection. A large volumetric attack must be filtered before it reaches the application.

With Bearly Secure still running, run and submit the CLI tests from the project root.