feat(rate-limit): per-user mutation-rate-limiting (v1-readiness #3)

lib/rate-limit.ts: 11 nieuwe scope-configs + enforceUserRateLimit(scope, userId)
helper. Returnt { error, code: 429 } shape voor consistent foutbeleid.

Toegepast op de high-value mutation-paths:
- actions/pbis.ts createPbiAction
- actions/stories.ts createStoryAction
- actions/tasks.ts saveTask (alleen create-path) + createTaskAction
- actions/todos.ts createTodoAction
- actions/sprints.ts createSprintAction
- actions/products.ts createProductAction + createProductFormAction
- actions/api-tokens.ts createApiTokenAction
- actions/questions.ts answerQuestion
- actions/claude-jobs.ts enqueueClaudeJobAction + enqueueClaudeJobsBatchAction
- app/api/profile/avatar/route.ts POST
- app/api/stories/[id]/log/route.ts POST

Limits zijn ruim genoeg voor normaal gebruik, eng genoeg voor abuse-loops:
create-task 100/min, create-todo 60/min, create-pbi 30/min, create-product
5/min, create-token 10/uur, etc. Per-user scope (geen globale block).

Niet aangeraakt: reorder/status-toggle (intra-session frequent, lage abuse),
update/delete (laag-volume), cron-routes (CRON_SECRET-gated).

Consumer-tweaks: 'success' in result narrowing waar TS de bredere union niet
meer accepteerde. Tests: 9 nieuwe op rate-limit-helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/api/profile/avatar/route.ts

@@ -3,6 +3,7 @@ import { getIronSession } from 'iron-session'
 import sharp from 'sharp'
 import { prisma } from '@/lib/prisma'
 import { SessionData, sessionOptions } from '@/lib/session'
+import { enforceUserRateLimit } from '@/lib/rate-limit'
 
 const MAX_BYTES = 12 * 1024 * 1024
 const ALLOWED_TYPES = new Set(['image/jpeg', 'image/png', 'image/webp'])
@@ -20,6 +21,9 @@ export async function POST(request: Request) {
     return Response.json({ error: 'Niet beschikbaar in demo-modus' }, { status: 403 })
   }
 
+  const limited = enforceUserRateLimit('upload-avatar', session.userId)
+  if (limited) return Response.json({ error: limited.error }, { status: 429 })
+
   const formData = await request.formData()
   const file = formData.get('avatar') as File | null
   if (!file || file.size === 0) {

app/api/stories/[id]/log/route.ts

@@ -3,6 +3,7 @@ import { prisma } from '@/lib/prisma'
 import { productAccessFilter } from '@/lib/product-access'
 import { Prisma } from '@prisma/client'
 import { z } from 'zod'
+import { enforceUserRateLimit } from '@/lib/rate-limit'
 
 const metadataField = z.record(z.string(), z.unknown()).optional()
 
@@ -39,6 +40,9 @@ export async function POST(
     return Response.json({ error: 'Niet beschikbaar in demo-modus' }, { status: 403 })
   }
 
+  const limited = enforceUserRateLimit('log-story', auth.userId)
+  if (limited) return Response.json({ error: limited.error }, { status: 429 })
+
   const { id: storyId } = await params
 
   const story = await prisma.story.findFirst({