⭐ Security Hardening

All 17 open CodeQL code-scanning alerts fixed.

16× js/missing-rate-limiting, flagged on every authorizing route handler across routes/user.ts, routes/profiles.ts, routes/articles.ts, routes/articles/comments.ts, and routes/articles/favorites.ts. Fixed with a new middleware/rateLimiter.ts — a createRateLimiter(overrides) factory rather than one fixed instance, specifically so tests can configure a tiny window instead of waiting out the real 15-minute production one — wired globally via app.use("/api", createRateLimiter()) ahead of every route mount, covering all 16 flagged handlers in one place rather than patching each router individually. Defaults to 100 requests / 15 minutes.

1× js/insecure-randomness, in the article seeder: Math.random() picked the random author for each seed article. Replaced with crypto.randomInt(), a CSPRNG — same behavior (still a uniformly random existing user), just not predictable.

Alerts close automatically once CodeQL re-scans main on push — codeql.yml triggers on every push, so this wasn't a one-off manual dismissal. See Middleware for the rest of this repo's middleware layer.