I lowkey forgot to commit

docs/07-rate-limits-and-caching.md

@@ -0,0 +1,23 @@
+# Rate Limits & Caching
+
+## Throttling
+- Requests are throttled per window (default 30s) to avoid bursts.
+- Separate caps for sensitive endpoints.
+- Configure via env:
+```bash
+SPOTIFY_RATE_WINDOW_SECONDS=30
+SPOTIFY_RATE_MAX_REQUESTS=50
+SPOTIFY_RATE_MAX_REQUESTS_SENSITIVE=20
+```
+
+## 429 handling
+- If Spotify returns 429, respects `Retry-After` and retries (up to 3 attempts).
+
+## Response caching
+- GET responses cached: search ~10 minutes, album ~1 hour.
+- Token responses are cached separately.
+
+## Batching
+- `getAlbums([ids])` provided for batch lookups.
+
+