Harden api security

[dewabisma]

• Remove unused endpoint
• Add API rate limit

[n13]

Reviewer model: GPT 5.6 Sol

Verdict: REQUEST_CHANGES — the limiter implementation is sound, but the endpoint removal leaves a published API contract pointing at a route that will no longer exist.

Blocking finding:

• server/src/app.ts removes POST /api/inquiries, while website/public/.well-known/openapi/website-api.json:21 still advertises it as a public operation and website/src/api/client.ts:108 still exports apiClient.contact() against that route. The OpenAPI document is currently served publicly at https://www.quantus.com/.well-known/openapi/website-api.json. After this server change is deployed, generated/external clients following that contract—and any future caller of the retained helper—will receive a 404. If retirement is intentional, remove or deprecate the OpenAPI operation and remove the stale client method/types in this PR (and version/communicate the breaking contract as appropriate); otherwise retain the route.

Validation:

• Reviewed exact head 0f571743ec23fbce335ce0bd581ef0f186e33b72 against base 88d5a7d9b50101dea9f183ca96ede6c7c856972e.
• npx --yes bun install --frozen-lockfile — passed.
• npx --yes bun run test — passed, 14/14 tests.
• npx --yes bun run build:release — passed.
• git diff --check 88d5a7d9b50101dea9f183ca96ede6c7c856972e...0f571743ec23fbce335ce0bd581ef0f186e33b72 — passed.
• GitHub reports no CI checks for this head. bun audit reports repository-wide pre-existing advisories, but none are attributable to the newly added express-rate-limit dependency graph.

[n13]

Reviewer model: GPT 5.6 Sol

Verdict: APPROVE — the previous API-contract blocker is resolved at the new head, and I found no blocking issues.

The removal of POST /api/inquiries is now reflected in both the published OpenAPI document and the website API client, keeping the server, public contract, and client surface aligned. The rate limiter validates its configuration, uses the one-hop proxy model expected for the Cloudflare path, and has focused coverage for threshold and per-client behavior.

Validation:

• Reviewed exact head 035b294d597e0d02a77f994974ba1769586fde0b against base 88d5a7d9b50101dea9f183ca96ede6c7c856972e.
• npx --yes bun run test — passed, 14/14 tests.
• npx --yes bun run build:release — passed.
• Changed frontend files passed Prettier and JSON parsing; npx --yes bun run build — passed.
• git diff --check 88d5a7d9b50101dea9f183ca96ede6c7c856972e...035b294d597e0d02a77f994974ba1769586fde0b — passed.
• GitHub reports no CI checks for this head. bun audit still reports repository-wide pre-existing advisories, but none belong to the newly added express-rate-limit dependency graph.