feat: add per-user rate limiting and concurrent job limits

Redis sliding window (sorted set) enforces per-user request rate limits
via the rateLimitPerUser DB setting. Concurrent job limits checked at
the HTTP layer before enqueue via maxConcurrentJobsPerUser setting.
Both default to 0 (unlimited).

apps/api/src/index.ts

@@ -317,6 +317,7 @@ await app.register(cookie, {
 
 // IP allowlist (enterprise -- must run before auth to reject early)
 import { registerIpAllowlist } from "./plugins/ip-allowlist.js";
+import { registerPerUserRateLimit } from "./plugins/per-user-rate-limit.js";
 
 await registerIpAllowlist(app);
 
@@ -326,6 +327,9 @@ await configRoutes(app);
 // Auth middleware (must be registered before routes it protects)
 await authMiddleware(app);
 
+// Per-user rate limiting (after auth so request.user is populated)
+await registerPerUserRateLimit(app);
+
 // Auth routes
 await authRoutes(app);