feat(rate-limit): per-user mutation-rate-limiting (v1-readiness #3)

lib/rate-limit.ts: 11 nieuwe scope-configs + enforceUserRateLimit(scope, userId)
helper. Returnt { error, code: 429 } shape voor consistent foutbeleid.

Toegepast op de high-value mutation-paths:
- actions/pbis.ts createPbiAction
- actions/stories.ts createStoryAction
- actions/tasks.ts saveTask (alleen create-path) + createTaskAction
- actions/todos.ts createTodoAction
- actions/sprints.ts createSprintAction
- actions/products.ts createProductAction + createProductFormAction
- actions/api-tokens.ts createApiTokenAction
- actions/questions.ts answerQuestion
- actions/claude-jobs.ts enqueueClaudeJobAction + enqueueClaudeJobsBatchAction
- app/api/profile/avatar/route.ts POST
- app/api/stories/[id]/log/route.ts POST

Limits zijn ruim genoeg voor normaal gebruik, eng genoeg voor abuse-loops:
create-task 100/min, create-todo 60/min, create-pbi 30/min, create-product
5/min, create-token 10/uur, etc. Per-user scope (geen globale block).

Niet aangeraakt: reorder/status-toggle (intra-session frequent, lage abuse),
update/delete (laag-volume), cron-routes (CRON_SECRET-gated).

Consumer-tweaks: 'success' in result narrowing waar TS de bredere union niet
meer accepteerde. Tests: 9 nieuwe op rate-limit-helper.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

components/settings/token-manager.tsx

@@ -38,7 +38,7 @@ export function TokenManager({ tokens, isDemo }: TokenManagerProps) {
   const [state, formAction] = useActionState(
     async (_prev: unknown, fd: FormData) => {
       const result = await createApiTokenAction(_prev, fd)
-      if (result.success && result.token) {
+      if ('success' in result && result.success && result.token) {
         setNewToken(result.token)
       }
       return result

components/todos/todo-list.tsx

@@ -255,11 +255,11 @@ function TodoCard({
   const [editState, editFormAction] = useActionState(updateTodoAction, undefined)
 
   useEffect(() => {
-    if (createState?.success) onSuccess()
+    if (createState && 'success' in createState && createState.success) onSuccess()
   }, [createState, onSuccess])
 
   useEffect(() => {
-    if (editState?.success) onSuccess()
+    if (editState && 'success' in editState && editState.success) onSuccess()
   }, [editState, onSuccess])
 
   if (mode === 'idle') {