feat: per-IP rate limit and write bans

Apply sliding-window 2/s limits and BannedIP checks on write routes.
Also force SVG attachment disposition and claim burn-after-read in DB
before streaming, deleting the file via BackgroundTask after the response.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/bans.py

@@ -0,0 +1,14 @@
+"""IP ban checks for write endpoints."""
+
+from __future__ import annotations
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.models import BannedIP
+
+
+def is_banned(db: Session, ip: str) -> bool:
+    if not ip:
+        return False
+    return db.scalar(select(BannedIP).where(BannedIP.ip == ip)) is not None