fix(routes): apply rate-limit and metrics middleware to /api/v2

The authenticated v1 group installs setupRateLimit and
setupMetricsMiddleware; the v2 group only had cache-control and token
middleware, so authenticated v2 endpoints bypassed the configured API
rate limiter and route metrics. Mirror the v1 stack.

pkg/routes/routes.go

@@ -382,6 +382,10 @@ func noStoreCacheControl() echo.MiddlewareFunc {
 func registerAPIRoutesV2(e *echo.Echo, a *echo.Group) {
 	a.Use(noStoreCacheControl())
 	a.Use(SetupTokenMiddleware())
+	// Match the authenticated v1 group: rate limiting and route metrics
+	// apply to v2 resource endpoints too.
+	setupRateLimit(a, config.RateLimitKind.GetString())
+	setupMetricsMiddleware(a)
 
 	api := apiv2.NewAPI(e, a)