fix notification and add billing page and contract

apps/api/src/middleware/rateLimiter.ts

@@ -4,13 +4,15 @@ import type { Request } from 'express'
 // req.ip is already the real client IP when app.set('trust proxy', 1) is configured
 const getClientIpKey = (req: Request) => ipKeyGenerator(req.ip ?? '')
 
-// Strict limiter for auth endpoints — prevents brute-force and credential stuffing
+// Strict limiter for auth endpoints — prevents brute-force and credential stuffing.
+// Successful requests (e.g. GET /me profile reads) are skipped so only failed
+// attempts count toward the cap.
 export const authLimiter = rateLimit({
   windowMs: 15 * 60 * 1000, // 15 minutes
   max: 20,
   standardHeaders: 'draft-7',
   legacyHeaders: false,
-  skipSuccessfulRequests: false,
+  skipSuccessfulRequests: true,
   keyGenerator: (req) => getClientIpKey(req),
   message: { error: 'too_many_requests', message: 'Too many attempts, please try again later', statusCode: 429 },
 })