fix: deduplicate concurrent price requests to prevent CoinGecko quota exhaustion

[luciachizaram]

Problem

ReflectorService.getFreshPrices() performs a read-check-write on this.lastRequestTime without any synchronisation:

const now = Date.now()
if (now - this.lastRequestTime < this.MIN_REQUEST_INTERVAL) {
    return {}
}
this.lastRequestTime = now

JavaScript's single-threaded event loop does not protect against this: await fetch() yields execution, allowing multiple coroutines to pass the guard before any of them updates lastRequestTime. With ≥4 concurrent BullMQ workers, all callers fire simultaneous HTTP requests to CoinGecko, exhausting the free-tier quota (10–30 req/min) in seconds.

After 429s, the service falls back to getFallbackPrices() which adds ±1% random noise to hardcoded base prices — rebalance thresholds may trigger or suppress incorrectly.

Fix

Add an inflightPriceRequest singleton promise gate. When a fetch is already in flight, subsequent callers reuse the same promise instead of firing a new request:

if (this.inflightPriceRequest) {
    return this.inflightPriceRequest
}

this.inflightPriceRequest = this._doFetchPrices(assets).finally(() => {
    this.inflightPriceRequest = null
})
return this.inflightPriceRequest

This collapses all concurrent callers onto one in-flight HTTP request, honouring the rate limit regardless of concurrency level. The .finally() ensures the gate is cleared whether the fetch succeeds or fails, so subsequent requests after completion proceed normally.

Changes

• backend/src/services/reflector.ts:
  • Added inflightPriceRequest property
  • getFreshPrices() now checks for and reuses in-flight requests
  • Extracted fetch logic to _doFetchPrices() for clarity

Fixes #28