fix: add rate limiting for Odesli/song.link API

- Implemented semaphore-based rate limiter (10 requests per minute)
- Odesli API allows 10 requests per 60 seconds
- Rate limiter ensures 1 request per 6 seconds maximum
- Prevents API rate limit violations
- Cache still used first (30 day TTL) to minimize API calls

allstarr/Controllers/JellyfinController.cs

@@ -4471,6 +4471,12 @@ public class JellyfinController : ControllerBase
                 return cachedSpotifyId;
             }
             
+            // RATE LIMITING: Odesli allows 10 requests per minute
+            // Use a simple semaphore-based rate limiter
+            await OdesliRateLimiter.WaitAsync();
+            
+            try
+            {
                 // Call Odesli API
                 var odesliUrl = $"https://api.song.link/v1-alpha.1/links?url={Uri.EscapeDataString(sourceUrl)}&userCountry=US";
                 
@@ -4520,12 +4526,25 @@ public class JellyfinController : ControllerBase
                 _logger.LogDebug("No Spotify link found in Odesli response for {Provider}/{ExternalId}", provider, externalId);
                 return null;
             }
+            finally
+            {
+                // Release rate limiter after 6 seconds (10 requests per 60 seconds = 1 request per 6 seconds)
+                _ = Task.Run(async () =>
+                {
+                    await Task.Delay(TimeSpan.FromSeconds(6));
+                    OdesliRateLimiter.Release();
+                });
+            }
+        }
         catch (Exception ex)
         {
             _logger.LogDebug(ex, "Error converting {Provider}/{ExternalId} via Odesli", provider, externalId);
             return null;
         }
     }
+    
+    // Static rate limiter for Odesli API (10 requests per minute = 1 request per 6 seconds)
+    private static readonly SemaphoreSlim OdesliRateLimiter = new SemaphoreSlim(10, 10);
 }
 
 // force rebuild Sun Jan 25 13:22:47 EST 2026