> Anything else, you likely need a transformation layer and also take into account Auth, rate limiting etc

You can do flexible auth in PostgREST, but also on an api-gateway. Are you right now doing rate limiting in the backend?