varutasu 708ef45a96 feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0) ... Closes P0 #6 from PARTIAL to RESOLVED. 8/8 P0s now closed. Extends lib/rate-limit.js from single-class to 5 named limiters (auth/search/upload/generate/import). Atomically gates the 3 import routes (auth + admin-role check + rate limit) and fixes pages/admin/card-import.js's missing Bearer header in the same commit (architect's critical discovery: API gating alone would have broken the admin UI). Per Decision 1 Option A. 10 files +185/-23. Local: lint 128 baseline, vitest 21/21. CI: Playwright smoke 3/3 in 3.8s, forbidden-cors-headers pass, all gates green. PR #20 architect-commit 60b842e, implementer-commit 51a3a97. Brief 4's login.js + register.js byte-identical.		2026-05-24 22:59:59 -05:00
..
brief-1-extend-rate-limit-and-wire-routes.md	feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0)	2026-05-24 22:59:59 -05:00