Introduce authentication framework with AuthConfig, AuthGate, and Authenticator classes, alongside comprehensive tests for rules, modes, and schemes.

src/main/java/dev/coph/nextusweb/server/ratelimit/RateLimitConfig.java

@@ -1,9 +1,12 @@
 package dev.coph.nextusweb.server.ratelimit;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
+import java.util.IdentityHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 
 /**
  * Immutable mapping from request paths to the {@link Rule rate-limit rules} that apply to them.
@@ -27,6 +30,8 @@ public final class RateLimitConfig {
     private final Map<String, Rule> exactPathRules;
     /** Prefix rules, pre-sorted longest-prefix-first so the most specific match wins. */
     private final List<PrefixRule> prefixRules;
+    /** Every distinct limiter referenced by any rule, by identity; used for periodic cleanup. */
+    private final Set<RateLimiter> allLimiters;
 
     /**
      * Builds an immutable configuration from a {@link Builder}, copying the exact-path rules
@@ -40,6 +45,15 @@ public final class RateLimitConfig {
         this.prefixRules = b.prefixRules.stream()
                 .sorted((a, c) -> Integer.compare(c.prefix.length(), a.prefix.length()))
                 .toList();
+
+        // Collect the distinct limiter instances once so the gate's periodic cleanup can iterate
+        // them. Identity-based de-duplication keeps a limiter shared across several rules from
+        // being cleaned multiple times per pass.
+        Set<RateLimiter> limiters = Collections.newSetFromMap(new IdentityHashMap<>());
+        if (globalRule != null) limiters.add(globalRule.limiter());
+        for (Rule r : exactPathRules.values()) limiters.add(r.limiter());
+        for (PrefixRule pr : prefixRules) limiters.add(pr.rule.limiter());
+        this.allLimiters = Collections.unmodifiableSet(limiters);
     }
 
     /**
@@ -79,6 +93,16 @@ public final class RateLimitConfig {
         return rules;
     }
 
+    /**
+     * Returns every distinct limiter referenced by this configuration, for periodic state
+     * eviction by {@link RateLimitGate}.
+     *
+     * @return the immutable set of distinct limiters (de-duplicated by identity)
+     */
+    public Set<RateLimiter> allLimiters() {
+        return allLimiters;
+    }
+
     /**
      * A single rate-limit rule: a limiter, the key resolver feeding it, and a name used to
      * namespace keys and aid diagnostics.