rate_limit: Additionally limit to 2000 authenticated requests per hour.

api_docs/http-headers.md

@@ -70,7 +70,8 @@ HTTP headers in all API responses:
 and can vary by server and over time. The default configuration
 currently limits:
 
-* Every user is limited to 200 total API requests per minute.
+* Every user is limited to 200 total API requests per minute, and 2000
+  total API requests per hour.
 * Separate, much lower limits for authentication/login attempts.
 
 When the Zulip server has configured multiple rate limits that apply

zproject/default_settings.py

@@ -266,6 +266,8 @@ DEFAULT_RATE_LIMITING_RULES = {
     "api_by_user": [
         # 200 requests per minute
         (60, 200),
+        # 2000 requests per hour
+        (3600, 2000),
     ],
     # Limits total number of unauthenticated API requests (primarily
     # used by the public access option). Since these are