Rate limiting per key rather than per address

A limit keyed on the client address, and four integrators behind one corporate gateway sharing a quota.

// before
RateLimiter::for('api', fn ($r) => Limit::perMinute(600)->by($r->ip()));

// after
RateLimiter::for('api', function (Request $r) {
    return $r->user()
        ? Limit::perMinute(600)->by($r->user()->apiKeyId)
        : Limit::perMinute(20)->by($r->ip());
});

Keying on the credential is the only fair unit when consumers are identified, and the address limit stays for unauthenticated requests where there is nothing else to key on. The lower unauthenticated limit is deliberate — an anonymous caller has no relationship to protect, and twenty a minute is generous for anything that should be authenticated.