feat(B-RL): Rate-Limiting Konsistenz — zentrale Policies für Auth/AI/Upload/Webhook

B-RL: Rate-Limiting auf zentrale check_rate_limit() umgestellt
- forgejo_error_reporter: In-Memory → zentrale Redis-Rate-Limit
- ai_proactive: eigene Redis-Logik → zentrale check_rate_limit()
- agent_runner: DB-basiertes Limit bleibt (zählt echte Ausführungen)
- RateLimitPolicy Enum (AUTH/AI/UPLOAD/WEBHOOK) + check_rate_limit_policy()
- 8 neue config.py Settings für Policy-Limits
- 12 Routes mit Policies versehen (login, password-reset, AI, uploads, webhooks)

Tests: 20 Tests in test_rate_limit_policies.py — alle grün
- Policies, check_rate_limit, reset, get_client_ip, forgejo, ai_proactive
- Keine Regression: 116 bestehende Tests grün

app/config.py

@@ -87,7 +87,7 @@ class Settings(BaseSettings):
     hnsw_ef_search: int = 40
     vector_index_type: Literal["hnsw", "ivfflat"] = "hnsw"
 
-    # Rate Limiting
+    # Rate Limiting — legacy per-endpoint settings (kept for backward compat)
     rate_limit_login_max: int = 5
     rate_limit_login_window: int = 900  # 15 min
     rate_limit_reset_max: int = 3
@@ -97,6 +97,16 @@ class Settings(BaseSettings):
     rate_limit_general_max: int = 300
     rate_limit_general_window: int = 60  # 1 min
 
+    # Rate Limiting — unified policies for abuse/cost-sensitive endpoints
+    rate_limit_auth_max: int = 5  # login, password-reset
+    rate_limit_auth_window: int = 300  # 5 minutes
+    rate_limit_ai_max: int = 20  # AI/LLM calls
+    rate_limit_ai_window: int = 60  # 1 minute
+    rate_limit_upload_max: int = 30  # file uploads
+    rate_limit_upload_window: int = 60  # 1 minute
+    rate_limit_webhook_max: int = 100  # incoming webhooks
+    rate_limit_webhook_window: int = 60  # 1 minute
+
     @property
     def cors_origin_list(self) -> list[str]:
         """Parse comma-separated CORS origins into a list."""