feat: better ratelimiting (#2520)

Replace hono-rate-limiter with a Prisma/PostgreSQL bucketed counter
approach that works correctly across multiple instances without sticky
sessions.

- Add RateLimit model with composite PK (key, action, bucket) and atomic
upsert
- Create rate limit factory with window parsing, bucket computation, and
fail-open
- Define auth-tier and API-tier rate limit instances
- Add Hono middleware, rateLimitResponse helper, and tRPC
assertRateLimit helper
- Wire rate limit headers through AppError constructor (was declared but
never assigned)
- Apply rate limits to auth routes (email-password, passkey), tRPC
routes
  (2FA email, link org account), API routes, and file upload endpoints
- Add cleanup cron job for expired rate limit rows (batched delete every
15 min)
- Remove hono-rate-limiter dependency

packages/trpc/server/enterprise-router/link-organisation-account.ts

@@ -1,4 +1,6 @@
 import { linkOrganisationAccount } from '@documenso/ee/server-only/lib/link-organisation-account';
+import { assertRateLimit } from '@documenso/lib/server-only/rate-limit/rate-limit-middleware';
+import { linkOrgAccountRateLimit } from '@documenso/lib/server-only/rate-limit/rate-limits';
 
 import { procedure } from '../trpc';
 import {
@@ -15,6 +17,13 @@ export const linkOrganisationAccountRoute = procedure
   .mutation(async ({ input, ctx }) => {
     const { token } = input;
 
+    const rateLimitResult = await linkOrgAccountRateLimit.check({
+      ip: ctx.metadata.requestMetadata.ipAddress ?? 'unknown',
+      identifier: token,
+    });
+
+    assertRateLimit(rateLimitResult);
+
     await linkOrganisationAccount({
       token,
       requestMeta: ctx.metadata.requestMetadata,