security: rate limit expensive routes, stop upload path traversal

[NetworkTheoryAppliedResearchInstitute]

Clears the nine open CodeQL alerts on main that #148 does not already cover. With #148 merged, Agrinet's code-scanning queue goes to zero.

What was wrong

js/path-injection — backend/models/message.js:31. file.name comes from the client and was concatenated straight into the write path:

const filename = Date.now() + '_' + file.name;
fs.writeFileSync(path.join(UPLOAD_DIR, filename), ...);

A message with file.name = "../../etc/passwd" wrote outside UPLOAD_DIR. Now the name is collapsed with path.basename, stripped to [A-Za-z0-9._-] (which also removes NUL bytes and leading dots), and the write is refused outright if the resolved path is not directly inside UPLOAD_DIR.

Checked against photo.png, ../../etc/passwd, ..%2f..%2fetc, ....//....//x, a/b/c.png, ../.ssh/authorized_keys, \0evil.sh, "", null, .., ..... — every one stays inside the directory.

js/missing-rate-limiting — 8 alerts. No limiter existed anywhere. Adds express-rate-limit and backend/middleware/rateLimit.js with three ceilings per 15-minute window:

limiter	cap	applied to
apiLimiter	600	global in server.js, plus agrotourism reads
writeLimiter	60	logs, deposits, conversations, communication
uploadLimiter	20	POST /create (up to 5 images)

The global limiter sits ahead of authMiddleware so unauthenticated floods are shed before any auth work happens.

actions/missing-workflow-permissions. check-hardcoded-urls.yml now declares contents: read.

Notes for review

• Limiters are applied at router level via .use(), not as an extra route argument. The tracked express stub registers routes as (path, handler) — inserting a third argument would have silently dropped the real handler.
• express-rate-limit was added with --package-lock-only so the three tracked stubs under backend/node_modules are untouched. A matching stub joins them (force-added, since backend/.gitignore:26 ignores node_modules/) so npm test runs without a full install.

Verification

npm test in backend/: 6/6 pass, identical to the pre-patch baseline. node --check clean on all eight touched JS files.

🤖 Generated with Claude Code

[NetworkTheoryAppliedResearchInstitute]

Superseded by #161: same changes, rebased onto current main and squashed into one commit whose Signed-off-by matches the commit author, which fixes the DCO failure here.