feat: exempt presigned download URL endpoint from rate limiting to support avatar rendering

src/upload/upload.controller.ts

@@ -11,6 +11,7 @@ import {
   Res,
   BadRequestException,
 } from '@nestjs/common';
+import { SkipThrottle } from '@nestjs/throttler';
 import {
   ApiTags,
   ApiOperation,
@@ -144,6 +145,7 @@ export class UploadController {
 
   @Get('presigned-download-url')
   @Public()
+  @SkipThrottle() // avatars load for every agent card — don't count against the per-user throttle
   @ApiOperation({ summary: 'Get a presigned download URL for an S3 key (public endpoint)' })
   @ApiQuery({ name: 'key', required: true, description: 'S3 key (e.g., avatars/uuid.png)' })
   @ApiResponse({ status: 200, description: 'Presigned URL returned successfully' })