feat(B-RL): Rate-Limiting Konsistenz — zentrale Policies für Auth/AI/Upload/Webhook

B-RL: Rate-Limiting auf zentrale check_rate_limit() umgestellt
- forgejo_error_reporter: In-Memory → zentrale Redis-Rate-Limit
- ai_proactive: eigene Redis-Logik → zentrale check_rate_limit()
- agent_runner: DB-basiertes Limit bleibt (zählt echte Ausführungen)
- RateLimitPolicy Enum (AUTH/AI/UPLOAD/WEBHOOK) + check_rate_limit_policy()
- 8 neue config.py Settings für Policy-Limits
- 12 Routes mit Policies versehen (login, password-reset, AI, uploads, webhooks)

Tests: 20 Tests in test_rate_limit_policies.py — alle grün
- Policies, check_rate_limit, reset, get_client_ip, forgejo, ai_proactive
- Keine Regression: 116 bestehende Tests grün

app/plugins/builtins/ai_proactive/services.py

@@ -75,19 +75,21 @@ async def push_suggestion(user_id: str, suggestion: dict[str, Any]) -> None:
 async def is_rate_limited(
     tenant_id: uuid.UUID, user_id: uuid.UUID, rate_limit_seconds: int
 ) -> bool:
-    """Check if user is rate-limited using Redis.
+    """Check if user is rate-limited via central check_rate_limit().
 
-    Returns True if rate-limited (key exists), False otherwise.
-    Sets a key with TTL = rate_limit_seconds on first call.
+    Delegates to ``app.core.rate_limit.check_rate_limit`` with ``max_attempts=1``
+    and ``window_seconds=rate_limit_seconds``.
+    Returns ``True`` if rate-limited, ``False`` if allowed.
     """
+    from app.core.rate_limit import check_rate_limit
+    from fastapi import HTTPException
+
+    redis_key = f"rate:ai_proactive:{tenant_id}:{user_id}"
     try:
-        r = get_cache()
-        key = f"ai_proactive:rate:{user_id}"
-        existing = await r.get(key)
-        if existing is not None:
-            return True
-        await r.setex(key, rate_limit_seconds, "1")
+        await check_rate_limit(redis_key, max_attempts=1, window_seconds=rate_limit_seconds)
         return False
+    except HTTPException:
+        return True
     except Exception:
         logger.exception("Rate-limit check failed, allowing request")
         return False