feat: global API rate limiting + webhook dispatcher wired to key events

Rate limiting (middleware-level):
- 120 requests/minute per IP for all /api/* routes
- Returns 429 with retry-after header when exceeded
- In-memory store (per-container, sufficient for single-instance)

Webhook dispatcher wired to events:
- license.created → fires when a new license is issued
- ticket.created → fires when a support ticket is created
- instance.provisioned → fires when a tenant instance goes live
- Each event includes relevant payload (key, product, URL, etc.)
- Fire-and-forget (doesn't block the response)
- HMAC-SHA256 signed (existing webhook.ts implementation)

Also:
- Ticket creation now sends email notification (sendTicketCreatedEmail)

src/middleware.ts

@@ -3,6 +3,30 @@ import { NextRequest, NextResponse } from 'next/server'
 // Middleware: protects all routes except public ones.
 // Uses a simple session cookie (HMAC-signed) for auth.
 // Password is set via ADMIN_PASSWORD env var.
+// Also applies global rate limiting to API routes.
+
+// --- Simple in-memory rate limiter (per-IP, per-minute) ---
+const rateLimitStore = new Map<string, { count: number; resetAt: number }>()
+const RATE_LIMIT_MAX = 120 // 120 requests per minute per IP
+const RATE_LIMIT_WINDOW = 60_000 // 1 minute
+
+function checkRateLimit(ip: string): boolean {
+  const now = Date.now()
+  const entry = rateLimitStore.get(ip)
+  if (!entry || entry.resetAt < now) {
+    rateLimitStore.set(ip, { count: 1, resetAt: now + RATE_LIMIT_WINDOW })
+    return true
+  }
+  if (entry.count >= RATE_LIMIT_MAX) return false
+  entry.count++
+  return true
+}
+
+function getClientIp(req: NextRequest): string {
+  return req.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
+    ?? req.headers.get('x-real-ip')
+    ?? 'unknown'
+}
 
 const PUBLIC_PATHS = [
   '/api/health',
@@ -91,6 +115,17 @@ async function verifySession(token: string | undefined): Promise<boolean> {
 export async function middleware(req: NextRequest) {
   const { pathname } = req.nextUrl
 
+  // --- Global rate limiting for API routes ---
+  if (pathname.startsWith('/api/')) {
+    const ip = getClientIp(req)
+    if (!checkRateLimit(ip)) {
+      return NextResponse.json(
+        { error: 'rate_limit_exceeded', message: 'Too many requests. Try again in a minute.' },
+        { status: 429, headers: { 'retry-after': '60' } }
+      )
+    }
+  }
+
   // Allow public paths
   if (isPublic(pathname)) {
     return NextResponse.next()