First step to handling:

 https://owasp.org/API-Security/editions/2023/en/0xa4-unrestricted-resource-consumption/

If the user requests @page_size > limit, interpret as though the limit has been
used.

OWASP includes cpu use, memory use etc. Some of these can be handled by ulimit settings
when running under gnuicorn or uwsgi. When running in a container similar memory and cpu
limits can be set.

Note that there is no limit AFAIK on the number of rows that can be retrieved via the web
interface either.