I didn't know about Vector, thanks, seems like a good tool for the job and probably very cheap to run on a tiny fly.io instance or similar. I might give that a shot.
Yeah I'm dealing with problems because of this right now. There are no easy ways to rate limit requests to postgREST so it's pretty trivial for someone to lock up the database by making legitimate rpc (plpgsql function) calls too fast. Investigating workarounds, but this really should be built into supabase.