varutasu 708ef45a96 feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0) ... Closes P0 #6 from PARTIAL to RESOLVED. 8/8 P0s now closed. Extends lib/rate-limit.js from single-class to 5 named limiters (auth/search/upload/generate/import). Atomically gates the 3 import routes (auth + admin-role check + rate limit) and fixes pages/admin/card-import.js's missing Bearer header in the same commit (architect's critical discovery: API gating alone would have broken the admin UI). Per Decision 1 Option A. 10 files +185/-23. Local: lint 128 baseline, vitest 21/21. CI: Playwright smoke 3/3 in 3.8s, forbidden-cors-headers pass, all gates green. PR #20 architect-commit 60b842e, implementer-commit 51a3a97. Brief 4's login.js + register.js byte-identical.		2026-05-24 22:59:59 -05:00
..
api-routes.mdc	feat(security): rate-limit search/upload/import + gate import routes (P0 #6 - closes last P0)	2026-05-24 22:59:59 -05:00
auth-and-permissions.mdc	docs: post-convoy cleanup for fix-auth-bypass	2026-05-23 12:22:50 -05:00
db-and-schema.mdc	bootstrap: agent pipeline v0.5.0 + ship-readiness review	2026-05-23 02:31:26 -05:00
no-go-zones.mdc	docs: post-convoy cleanup for drop-public-setup	2026-05-23 17:06:35 -05:00
schema-map.mdc	bootstrap: agent pipeline v0.5.0 + ship-readiness review	2026-05-23 02:31:26 -05:00
ui-and-theming.mdc	bootstrap: agent pipeline v0.5.0 + ship-readiness review	2026-05-23 02:31:26 -05:00