feat(security): add rate limiting to public POST routes

Add rateLimit protection to /api/paypal/create, /api/paypal/capture, /api/tokens, /api/radio/shouts, and /api/articles/[slug]/comment to prevent abuse and spamming.

src/app/api/articles/[slug]/comment/route.ts

@@ -10,6 +10,7 @@ import { eq } from "drizzle-orm";
 import { apiError, apiJson } from "@/lib/api";
 import { bearerUserId } from "@/lib/api-auth";
 import { db, WebsiteArticleComments, WebsiteArticles } from "@/lib/db";
+import { rateLimit } from "@/lib/rate-limit";
 
 export async function POST(
 	req: Request,
@@ -18,6 +19,10 @@ export async function POST(
 	const uid = await bearerUserId(req);
 	if (!uid) return apiError("Unauthorized", 401);
 
+	if (!(await rateLimit(`article-comment:${uid}`, 10, 60_000)).ok) {
+		return apiError("Too many comments. Please wait a minute.", 429);
+	}
+
 	const { slug } = await params;
 
 	const body = (await req.json().catch(() => ({}))) as { comment?: unknown };