fix(rate-limit): mitigate cache flooding vulnerability (#94)

Update in-memory rate limiter to fail secure (reject new requests) when maximum capacity is reached, rather than evicting the oldest tracking entry. This prevents an attacker from bypassing their rate limit by flooding the store with spoofed `x-forwarded-for` IPs to intentionally trigger cache eviction. Also cleaned up temporary files and updated tests to verify the behavior.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

lib/rate-limit.ts

@@ -67,12 +67,10 @@ export function checkRateLimit(
   // New window or expired
   if (!entry || now > entry.expiresAt) {
     if (store.size >= MAX_STORE_ENTRIES) {
-      // Store is full. Evict the oldest entry (FIFO) to prevent a global DoS
-      // where an attacker fills the store with spoofed IPs, locking out legitimate users.
-      const oldestKey = store.keys().next().value;
-      if (oldestKey !== undefined) {
-        store.delete(oldestKey);
-      }
+      // Store is full. Prevent adding new entries to mitigate cache flooding
+      // where an attacker spams spoofed IPs to evict legitimate users.
+      // Deny new unrecognized IPs to fail securely during an active flood.
+      return { success: false, remaining: 0, resetAt: now + windowMs };
     }
     const resetAt = now + windowMs;
     store.set(key, { count: 1, expiresAt: resetAt });