fix(security): wire RATE_LIMIT_IDS to endpoints & add regression test contract (#2039)

[Samarth1306w]

Issue

Closes #2039

Summary

1. Adds a regression unit test contract (rate-limit-ids.test.ts) that asserts every RATE_LIMIT_ID declared in lib/rate-limit.ts is referenced at least once outside the declaration file.
2. Wires RATE_LIMIT_IDS.GUEST_CHECKOUT to the guest checkout route (apps/web/app/api/settings/billing/guest-checkout/route.ts).
3. Wires RATE_LIMIT_IDS.ANALYTICS_TRACK to the analytics tracking route (apps/web/app/api/analytics/track/route.ts).

Acceptance criteria

• Adds unit test asserting all declared RATE_LIMIT_IDS are referenced outside rate-limit.ts
• Wires GUEST_CHECKOUT rate limiter to prevent unauthed Stripe checkout session abuse
• Wires ANALYTICS_TRACK rate limiter to prevent Tinybird ingest & notification mailbomb DoS
• All existing tests pass

/claim #2039

Greptile Summary

The PR adds Vercel Firewall rate-limit checks to the public analytics-tracking and guest-checkout routes and introduces a unit-test contract intended to detect unused rate-limit IDs.

• Rejects rate-limited analytics and checkout requests with HTTP 429.
• Scans TypeScript sources for references to every declared RATE_LIMIT_IDS entry.
• The new contract test currently fails because five pre-existing declarations are still unreferenced.

Confidence Score: 4/5

The contract-test failure must be fixed before merging because the apps/web unit suite will fail on five existing unreferenced rate-limit IDs.

The route guards follow the shared limiter contract, but the newly added test iterates all declarations and asserts none are unreferenced even though five declarations have no references in the scanned source tree.

Files Needing Attention: apps/web/tests/unit/rate-limit-ids.test.ts

Important Files Changed

Filename	Overview
apps/web/tests/unit/rate-limit-ids.test.ts	Adds a source-scanning contract test, but its empty-list assertion deterministically fails for five currently unreferenced IDs.
apps/web/app/api/analytics/track/route.ts	Adds an early ANALYTICS_TRACK rate-limit check and a clear HTTP 429 response before analytics processing.
apps/web/app/api/settings/billing/guest-checkout/route.ts	Adds an early GUEST_CHECKOUT rate-limit check before parsing the request or creating a Stripe checkout session.

Prompt To Fix All With AI

### Issue 1
apps/web/__tests__/unit/rate-limit-ids.test.ts:37-47
**Unreferenced IDs break contract test**

When the apps/web unit suite runs, this loop adds `AUTH_OTP_VERIFY`, `AUTH_OTP_SEND`, `LOOM_DOWNLOAD`, `MESSENGER_MESSAGE`, and `DESKTOP_LOGS` to `unreferencedKeys` because they have no references outside the excluded declaration file, causing the new assertion to fail deterministically.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

_{Reviews (1): Last reviewed commit: "fix(security): wire RATE_LIMIT_IDS to gu..." | Re-trigger Greptile}

Greptile also left 1 inline comment on this PR.

[superagent-security]

🚨 Contributor flagged. Click here for more info: Superagent Dashboard

[greptile-apps]

Unreferenced IDs break contract test

When the apps/web unit suite runs, this loop adds AUTH_OTP_VERIFY, AUTH_OTP_SEND, LOOM_DOWNLOAD, MESSENGER_MESSAGE, and DESKTOP_LOGS to unreferencedKeys because they have no references outside the excluded declaration file, causing the new assertion to fail deterministically.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/web/__tests__/unit/rate-limit-ids.test.ts
Line: 37-47

Comment:
**Unreferenced IDs break contract test**

When the apps/web unit suite runs, this loop adds `AUTH_OTP_VERIFY`, `AUTH_OTP_SEND`, `LOOM_DOWNLOAD`, `MESSENGER_MESSAGE`, and `DESKTOP_LOGS` to `unreferencedKeys` because they have no references outside the excluded declaration file, causing the new assertion to fail deterministically.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.