feat(security): add Redis-backed rate limiting and CSP/security headers

Public go-live hardening: Redis-backed rate limiting on the previously
invite-gated public surface (explore browsing, post/comment creation,
invite-cookie routes) plus CSP, HSTS, and standard security headers on
every response, now that the invite gate no longer filters traffic.

src/__tests__/media-upload.test.ts

@@ -80,11 +80,13 @@ function createTestCaller(
     userId: string | null;
     prisma: import("@prisma/client").PrismaClient;
     locale: string;
+    ip: string;
   };
   const ctx: CallerCtx = {
     userId,
     prisma: mockPrisma as unknown as import("@prisma/client").PrismaClient,
     locale: "en",
+    ip: "test",
   };
   return mediaRouter.createCaller(ctx);
 }

src/__tests__/pet-profile.test.ts

@@ -54,11 +54,12 @@ function createTestCaller(userId: string, mockPrisma: ReturnType<typeof createMo
   // petsRouter.createCaller accepts the same context shape as createTRPCContext returns.
   // Cast the mock to the expected PrismaClient type — mock has the same interface for
   // tested methods.
-  type CallerCtx = { userId: string | null; prisma: import("@prisma/client").PrismaClient; locale: string };
+  type CallerCtx = { userId: string | null; prisma: import("@prisma/client").PrismaClient; locale: string; ip: string };
   const ctx: CallerCtx = {
     userId,
     prisma: mockPrisma as unknown as import("@prisma/client").PrismaClient,
     locale: "en",
+    ip: "test",
   };
   return petsRouter.createCaller(ctx);
 }