feat: per-IP rate limit and write bans

Apply sliding-window 2/s limits and BannedIP checks on write routes.
Also force SVG attachment disposition and claim burn-after-read in DB
before streaming, deleting the file via BackgroundTask after the response.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/bans.py

@@ -0,0 +1,14 @@
+"""IP ban checks for write endpoints."""
+
+from __future__ import annotations
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.models import BannedIP
+
+
+def is_banned(db: Session, ip: str) -> bool:
+    if not ip:
+        return False
+    return db.scalar(select(BannedIP).where(BannedIP.ip == ip)) is not None

backend/app/services/items.py

@@ -134,11 +134,15 @@ def get_file_item(db: Session, slug: str) -> Item | None:
     return item
 
 
-def burn_file_item(db: Session, item: Item) -> None:
-    """Mark a file item burned and remove its bytes from disk."""
+def claim_burn(db: Session, item: Item) -> None:
+    """Mark burn consumed in DB before streaming bytes."""
     item.burned = True
-    path = resolve_file_path(item)
     db.commit()
+
+
+def delete_item_file(item: Item) -> None:
+    """Remove file bytes from disk (safe after response has finished streaming)."""
+    path = resolve_file_path(item)
     if path is not None:
         try:
             path.unlink(missing_ok=True)
@@ -146,6 +150,12 @@ def burn_file_item(db: Session, item: Item) -> None:
             pass
 
 
+def burn_file_item(db: Session, item: Item) -> None:
+    """Mark a file item burned and remove its bytes from disk."""
+    claim_burn(db, item)
+    delete_item_file(item)
+
+
 def get_item(db: Session, slug: str) -> Item | None:
     item = db.scalar(select(Item).where(Item.slug == slug))
     if item is None or _is_unavailable(item):

backend/app/services/rate_limit.py

@@ -0,0 +1,40 @@
+"""In-memory sliding-window rate limit (per IP)."""
+
+from __future__ import annotations
+
+import threading
+import time
+from collections import defaultdict, deque
+
+from app import config
+
+_lock = threading.Lock()
+_hits: dict[str, deque[float]] = defaultdict(deque)
+
+
+def reset() -> None:
+    """Clear all tracked hits (tests)."""
+    with _lock:
+        _hits.clear()
+
+
+def allow(ip: str, *, now: float | None = None) -> bool:
+    """Return True if ``ip`` may proceed; record the hit when allowed.
+
+    Allows when the number of hits in the last 1.0s is strictly less than
+    ``settings.rate_limit_per_second``.
+    """
+    if not ip:
+        ip = ""
+    limit = config.settings.rate_limit_per_second
+    ts = time.monotonic() if now is None else now
+    window_start = ts - 1.0
+
+    with _lock:
+        q = _hits[ip]
+        while q and q[0] <= window_start:
+            q.popleft()
+        if len(q) >= limit:
+            return False
+        q.append(ts)
+        return True