[xO-ox-ai]

Summary

Fix rate limiting for E2EE requests from allowed IPs when "Bypass rate limiting for allowed IPs" is enabled. The existing allow-list check only covers user-specific limits, so the E2EE server-key endpoint still applies its IP limit to allowed clients, including authenticated users falling back to an anonymous limit.

Move the existing opt-in bypass check before selecting user or IP limits. Add regression coverage for both annotations and attributes, anonymous requests, authenticated fallback requests, user-specific limits, and enabled/disabled settings with listed/unlisted IPs.

Validation

• PHPUnit 11.5.57 / PHP 8.4.27: 24 isolated middleware tests, 156 assertions, all passing. The unchanged middleware fails the four IP-bypass regression cases.
• Nextcloud coding standard: both changed files pass PHP CS Fixer; PHP syntax and Git whitespace checks pass.
• The autoloader checker was attempted but cannot complete in this sparse checkout because apps/dav/composer is absent. The full Nextcloud test suite has not been run locally.

Checklist

• Code is properly formatted.
• Sign-off message is added to all commits; the contributor will sign personally.
• Unit tests are included.
• No frontend changes or documentation changes are required.

AI

Codex (GPT-6) assisted with implementation and regression tests. The commit includes an Assisted-by trailer.