fix(event): isolate verified browsers behind shared NAT

[AsperforMias]

Context

At an event, many legitimate browser users can share one public IP. The previous scan and roast limits used that IP as the only identity, so one active participant could consume another participant's scan or default-model roast budget.

Change

• After /api/scan successfully verifies Turnstile, issue a 12-hour signed, HttpOnly, SameSite=Lax anonymous browser-session cookie.
• Use that verified session as the primary scan, roast-request, and default-model generation limiter key.
• Retain a deliberately wider IP-level budget as the second-line network-abuse control:
  • scan: 60 / minute
  • roast requests: 120 / minute
  • default-model generation: 48 / minute and 480 / day
• Keep CLI/MCP callers on their original IP-based limiter path.
• Reject forged, expired, malformed, or unverified session cookies by falling back to the original IP key.
• When Turnstile is unavailable or not configured, do not mint a session and preserve the original IP-only behavior.

Scope

No score formula, release version, quick scan, LLM provider, durable work, worker, or Cron behavior changes.

Verification

• pnpm exec vitest run src/lib/__tests__/anonymous-session.test.ts src/lib/__tests__/redis-rate-limit.test.ts src/app/api/scan/route.test.ts src/app/api/roast/route.test.ts
• pnpm typecheck
• pnpm lint
• pnpm versions:check (v9/v9/v4 canonical guard passed)
• pnpm test (67 files, 507 tests)
• pnpm build

Rollout check

After deployment, use two separate browser profiles on the same network. Each should complete a Turnstile-backed scan and roast independently; machine-authenticated callers remain IP-limited. Production must retain its existing Turnstile server secret for the per-browser isolation path to activate.

[vercel]

@AsperforMias is attempting to deploy a commit to the hikariming's projects Team on Vercel.

A member of the Team first needs to authorize it.