10. CORS, HTTPS, rate limiting and API keys

builder.Services.AddCors(o => o.AddPolicy("spa", p => p.WithOrigins("https://app.example.com")
    .AllowAnyHeader().AllowAnyMethod().AllowCredentials()));
app.UseCors("spa");

builder.Services.AddRateLimiter(o =>
{
    o.RejectionStatusCode = StatusCodes.Status429TooManyRequests;
    o.AddFixedWindowLimiter("per-client", l => { l.PermitLimit = 100; l.Window = TimeSpan.FromMinutes(1); });
    // also: sliding window, token bucket, concurrency limiters; partition by user/IP with PartitionedRateLimiter
});
app.UseRateLimiter();
app.MapGet("/api/search", Search).RequireRateLimiting("per-client");