feat: per-IP rate limit and write bans

Apply sliding-window 2/s limits and BannedIP checks on write routes.
Also force SVG attachment disposition and claim burn-after-read in DB
before streaming, deleting the file via BackgroundTask after the response.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/app/services/items.py

@@ -134,11 +134,15 @@ def get_file_item(db: Session, slug: str) -> Item | None:
     return item
 
 
-def burn_file_item(db: Session, item: Item) -> None:
-    """Mark a file item burned and remove its bytes from disk."""
+def claim_burn(db: Session, item: Item) -> None:
+    """Mark burn consumed in DB before streaming bytes."""
     item.burned = True
-    path = resolve_file_path(item)
     db.commit()
+
+
+def delete_item_file(item: Item) -> None:
+    """Remove file bytes from disk (safe after response has finished streaming)."""
+    path = resolve_file_path(item)
     if path is not None:
         try:
             path.unlink(missing_ok=True)
@@ -146,6 +150,12 @@ def burn_file_item(db: Session, item: Item) -> None:
             pass
 
 
+def burn_file_item(db: Session, item: Item) -> None:
+    """Mark a file item burned and remove its bytes from disk."""
+    claim_burn(db, item)
+    delete_item_file(item)
+
+
 def get_item(db: Session, slug: str) -> Item | None:
     item = db.scalar(select(Item).where(Item.slug == slug))
     if item is None or _is_unavailable(item):