Seems to me like standard dumb rate limiting (max 100r/min or like 250r/5min) per IP would solve the problem easily without affecting human users at all.
Surprised this isn’t a feature in Gitea already (even though it is better done in the reverse proxy web server).
Some scummy scrapers are snowshoeing their way through scads of (residential) IPs, just for one example.
Assuming that there are simple universal solutions, eg based on IP or UA, suggests that you have been lucky enough not to deal with many varieties of this misbehaviour.
Surprised this isn’t a feature in Gitea already (even though it is better done in the reverse proxy web server).