feat(security): add rate limiting to public POST routes

Add rateLimit protection to /api/paypal/create, /api/paypal/capture, /api/tokens, /api/radio/shouts, and /api/articles/[slug]/comment to prevent abuse and spamming.

src/app/api/tokens/route.ts

@@ -9,6 +9,7 @@ import { apiError, apiJson } from "@/lib/api";
 import { issueToken } from "@/lib/api-auth";
 import { auth } from "@/lib/auth";
 import { sessionUserId } from "@/lib/auth/session-user";
+import { rateLimit } from "@/lib/rate-limit";
 
 export async function POST(req: Request) {
 	const session = await auth();
@@ -17,6 +18,10 @@ export async function POST(req: Request) {
 		return apiError("Unauthorized", 401);
 	}
 
+	if (!(await rateLimit(`tokens-issue:${id}`, 5, 60_000)).ok) {
+		return apiError("Too many token requests. Please wait a minute.", 429);
+	}
+
 	const body = (await req.json().catch(() => ({}))) as { name?: unknown };
 	const rawName = typeof body.name === "string" ? body.name.trim() : "";
 	const name = rawName ? rawName.slice(0, 100) : "api";