feat(B-RL): Rate-Limiting Konsistenz — zentrale Policies für Auth/AI/Upload/Webhook

B-RL: Rate-Limiting auf zentrale check_rate_limit() umgestellt
- forgejo_error_reporter: In-Memory → zentrale Redis-Rate-Limit
- ai_proactive: eigene Redis-Logik → zentrale check_rate_limit()
- agent_runner: DB-basiertes Limit bleibt (zählt echte Ausführungen)
- RateLimitPolicy Enum (AUTH/AI/UPLOAD/WEBHOOK) + check_rate_limit_policy()
- 8 neue config.py Settings für Policy-Limits
- 12 Routes mit Policies versehen (login, password-reset, AI, uploads, webhooks)

Tests: 20 Tests in test_rate_limit_policies.py — alle grün
- Policies, check_rate_limit, reset, get_client_ip, forgejo, ai_proactive
- Keine Regression: 116 bestehende Tests grün

app/routes/ai_copilot.py

@@ -4,10 +4,11 @@ from __future__ import annotations
 
 import uuid
 
-from fastapi import APIRouter, Depends, HTTPException, Query, status
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
+from app.core.rate_limit import RateLimitPolicy, check_rate_limit_policy, get_client_ip
 from app.deps import get_current_user, require_permission
 from app.schemas.ai_copilot import (
     CopilotExecuteRequest,
@@ -21,6 +22,7 @@ router = APIRouter(prefix="/api/v1/ai/copilot", tags=["ai-copilot"])
 @router.post("/query")
 async def copilot_query(
     body: CopilotQueryRequest,
+    request: Request,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("ai:write")),
 ):
@@ -32,6 +34,12 @@ async def copilot_query(
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
 
+    # Rate limit — AI policy (cost-sensitive LLM call)
+    await check_rate_limit_policy(
+        f"rate:ai:copilot:{tenant_id}:{user_id}",
+        RateLimitPolicy.AI,
+    )
+
     result = await ai_copilot_service.process_query(
         db,
         tenant_id,
@@ -53,6 +61,7 @@ async def copilot_query(
 @router.post("/execute")
 async def copilot_execute(
     body: CopilotExecuteRequest,
+    request: Request,
     db: AsyncSession = Depends(get_db),
     current_user: dict = Depends(require_permission("ai:write")),
 ):
@@ -63,6 +72,12 @@ async def copilot_execute(
     """
     tenant_id = uuid.UUID(current_user["tenant_id"])
     user_id = uuid.UUID(current_user["user_id"])
+
+    # Rate limit — AI policy (cost-sensitive LLM call)
+    await check_rate_limit_policy(
+        f"rate:ai:copilot:{tenant_id}:{user_id}",
+        RateLimitPolicy.AI,
+    )
     resolved = {
         "permissions": current_user.get("permissions", []),
         "denied": current_user.get("denied_permissions", []),