actions: ideas CRUD + grill_md/plan_md edit + download (M12 T-496)

actions/ideas.ts (strikt user_id-only, geen productAccessFilter):
- createIdeaAction(input) — atomic nextIdeaCode + idea.create in $transaction
- updateIdeaAction(id, input) — guards on isIdeaEditable
- archiveIdeaAction / unarchiveIdeaAction
- deleteIdeaAction — refuses when pbi_id linked
- updateGrillMdAction — only in GRILLED|PLAN_READY; logs IdeaLog{NOTE}
- updatePlanMdAction — only in PLAN_READY; runs parsePlanMd; 422 with details on fail
- downloadIdeaMdAction — read-only, demo allowed

Added rate-limit configs: create-idea, edit-idea-md, start-idea-job,
materialize-idea.

Tests: 19 cases covering auth (401), demo (403), zod (422), status guards
(422), 404 cross-user-scope, plan-md parse-fail with details.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/rate-limit.ts

@@ -26,6 +26,12 @@ const CONFIGS: Record<string, RateLimitConfig> = {
   'log-story': { windowMs: 60_000, max: 60 },
   'upload-avatar': { windowMs: 3_600_000, max: 20 },
   'answer-question': { windowMs: 60_000, max: 30 },
+
+  // M12 — Idea entity (zie docs/plans/M12-ideas.md)
+  'create-idea': { windowMs: 60_000, max: 30 },
+  'edit-idea-md': { windowMs: 60_000, max: 60 },        // grill_md / plan_md edits
+  'start-idea-job': { windowMs: 60_000, max: 10 },      // Grill / Make Plan triggers
+  'materialize-idea': { windowMs: 60_000, max: 5 },
 }
 
 const DEFAULT_CONFIG: RateLimitConfig = { windowMs: 60_000, max: 10 }