feat: per-IP rate limit and write bans

Apply sliding-window 2/s limits and BannedIP checks on write routes.
Also force SVG attachment disposition and claim burn-after-read in DB
before streaming, deleting the file via BackgroundTask after the response.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/tests/conftest.py

@@ -14,9 +14,13 @@ def client(tmp_path: Path, monkeypatch: pytest.MonkeyPatch):
     import app.config as config_module
     import app.db as db_module
     import app.main as main_module
+    from app.services import rate_limit as rate_limit_module
 
     settings = Settings(_env_file=None, DATA_DIR=tmp_path)
     config_module.settings = settings
+    # Multi-create tests are not about rate limits; the dedicated test sets 2/s.
+    monkeypatch.setattr(config_module.settings, "rate_limit_per_second", 10_000)
+    rate_limit_module.reset()
 
     engine = create_engine(
         settings.db_url,