[SAFETY-001] Add anti-spam rate limits

[chev0004]

Outline

Summary

Adds server-side rate limiting for report submissions, profile bumps, username copy notifications, and failed Discord OAuth callbacks, with suspicious activity logging that admins can inspect.

---

Changes & Enhancements

• Type of Change:
  • Feature
  • Bugfix
  • Refactor
  • Chore
• Changes:
  • (Database):
    • Add rate_limit_counters table backing a fixed-window upsert counter.
    • Add suspicious_activity table logging violations with action, user, and IP.
  • (Server):
    • Add enforceRateLimit helper with per-action limits overridable via POLYCORD_RATE_LIMIT_* env vars.
    • Enforce per-user limits on /api/report, /api/profile/bump, and copy notifications, returning 429 with Retry-After.
    • Count failed Discord OAuth callbacks per IP and redirect with oauth_rate_limited once over the limit.
    • Add admin-only /api/admin/suspicious-activity endpoint listing recent violations.
  • (Client):
    • Show a cooldown toast when report submission is rate limited.
  • (i18n):
    • Add report cooldown copy to en and ja.

---

Page / App Changes

Affected Next.js Routes (Local):

• /[lang] (discovery: report cooldown toast)
• /[lang]/u/[id] (public profile: report cooldown toast)

Before (Screenshot)

After (Screenshot)

---

Component / Storybook Changes

Affected Storybook Components (Local):

Before (Screenshot)

After (Screenshot)

---

Not Doing

• Rate limiting partner intro requests: the connection flow (CONNECT-001) was aborted, so no endpoint exists to limit.

---

Other (Remarks)

---

Checklists

• Code is well-documented (comments, JSDoc, etc.).
• Existing comments were updated as needed.
• No out-of-scope changes are included.
• Write TODO comments where future work is required.
• Removed unnecessary debug code (e.g., console.log, debugger).
• Self-reviewed and tested locally.