feat(B-RL): Rate-Limiting Konsistenz — zentrale Policies für Auth/AI/Upload/Webhook

B-RL: Rate-Limiting auf zentrale check_rate_limit() umgestellt
- forgejo_error_reporter: In-Memory → zentrale Redis-Rate-Limit
- ai_proactive: eigene Redis-Logik → zentrale check_rate_limit()
- agent_runner: DB-basiertes Limit bleibt (zählt echte Ausführungen)
- RateLimitPolicy Enum (AUTH/AI/UPLOAD/WEBHOOK) + check_rate_limit_policy()
- 8 neue config.py Settings für Policy-Limits
- 12 Routes mit Policies versehen (login, password-reset, AI, uploads, webhooks)

Tests: 20 Tests in test_rate_limit_policies.py — alle grün
- Policies, check_rate_limit, reset, get_client_ip, forgejo, ai_proactive
- Keine Regression: 116 bestehende Tests grün

app/routes/attachments.py

@@ -5,11 +5,12 @@ from __future__ import annotations
 import os
 import uuid
 
-from fastapi import APIRouter, Depends, File, Form, HTTPException, UploadFile, status
+from fastapi import APIRouter, Depends, File, Form, HTTPException, Request, UploadFile, status
 from fastapi.responses import FileResponse
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.core.db import get_db
+from app.core.rate_limit import RateLimitPolicy, check_rate_limit_policy
 from app.deps import require_permission
 from app.services import attachment_service
 
@@ -18,6 +19,7 @@ router = APIRouter(prefix="/api/v1/attachments", tags=["attachments"])
 
 @router.post("", status_code=status.HTTP_201_CREATED)
 async def upload_attachment(
+    request: Request,
     file: UploadFile = File(...),
     entity_type: str = Form(...),
     entity_id: str = Form(...),
@@ -29,6 +31,12 @@ async def upload_attachment(
     user_id = uuid.UUID(current_user["user_id"])
     is_admin = current_user.get("is_system_admin", False)
 
+    # Rate limit — UPLOAD policy
+    await check_rate_limit_policy(
+        f"rate:upload:attachments:{tenant_id}:{user_id}",
+        RateLimitPolicy.UPLOAD,
+    )
+
     try:
         eid = uuid.UUID(entity_id)
     except ValueError: