fix: persist burn interactions via API and add rate limiting to analytics endpoint

[mftee]

Summary

• Wires the burn button in PostCard to POST /api/posts/:id/burn so interactions are persisted to the database; applies optimistic UI update immediately and rolls back on failure; uses the server-returned count to reconcile the displayed burn count
• Adds lib/rate-limit.ts — a simple in-memory token-bucket limiter (no extra dependencies) and applies it to POST /api/analytics/events at 60 requests per minute per IP, returning 429 when exceeded
• The analytics route already uses auth() for userId rather than the client-controlled x-user-id header

closes #179
closes #200

[drips-wave]

@mftee Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits