fix(newsletter): rate limit signups and stop resending welcome email

[waterlemonnn]

Closes #60.

POST /api/newsletter was the one public write route without consumeSharedRateLimit — unlike posts, comments, vote, upload/presign, and teams/waitlist. That made it the cheapest endpoint to abuse: a script could enqueue unlimited welcome emails to arbitrary addresses (a third-party email-bomb primitive on our domain), and every request costs a Resend send plus a Supabase write.

• Apply consumeSharedRateLimit keyed by IP, same pattern as teams/waitlist/route.ts (3 req / hour — tighter than waitlist's 5/hour since a real signup only happens once).
• Exceeding the limit returns 429 before touching the database or sending mail.
• Also closed the amplification path called out in the issue: a repeat signup for an address that's already status: active no longer re-sends the welcome email. It still sends on a genuinely new signup, and on reactivation (existing row moving from a non-active status back to active).

Verify

npx tsc --noEmit   # clean
npm run lint       # clean
npx vitest run     # 91 passed (11 files), including 4 new tests in app/api/newsletter/route.test.ts

New tests cover: new-subscriber welcome send, no resend for an already-active subscriber, resend on reactivation, and 429 short-circuits before any DB/email call.

[github-actions]

Merged, @waterlemonnn. Thank you for taking the time.

Contributions like this are what keep agentpostmortem moving.

A star on the repo would mean a lot if this project is useful to you.

Happy to see more from you whenever you have the time.