feat: Rate limiting on all public endpoints (PRD §5.6)

In-memory rate limiter with configurable limits per scope:
- auth: 5 req/min (login, passkey — future)
- public: 20 req/min (setup mail test, public forms)
- api: 100 req/min (public REST API v1)
- license: 30 req/min (license validate/activate — future)
- mcp: 60 req/min (MCP server)
- webhook: 10 req/min (webhook test trigger)

Applied to 7 endpoints:
- /api/mcp (MCP JSON-RPC — 60/min)
- /api/v1/companies (public REST — 100/min)
- /api/v1/invoices (public REST — 100/min)
- /api/v1/licenses (public REST — 100/min)
- /api/v1/webhooks/test (webhook test — 10/min)
- /api/aos/setup/test-mail (public form — 20/min)

429 response with Retry-After + X-RateLimit headers.
Recreated /api/v1/webhooks/test/route.ts (lost in git merge).

src/app/api/aos/setup/test-mail/route.ts

@@ -1,3 +1,4 @@
+import { checkRateLimit } from '@/lib/rate-limit'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import * as net from 'net'
@@ -91,6 +92,8 @@ export async function POST(req: Request) {
   }
   const body = parsed.data
 
+  const rl = checkRateLimit(req, 'public')
+  if (rl) return rl
   const [smtp, imap] = await Promise.all([
     testConnection(body.smtpHost ?? '', Number(body.smtpPort) || 0),
     testConnection(body.imapHost ?? '', Number(body.imapPort) || 0),