No rate limiting on /collect, /t, or API-key validation

Severity: High · Where: collect.ts:72-105; api-keys.ts:39-114 (cf. errors.ts:283 which IS limited) Ingest and key-validation endpoints have no rate limiting. Impact: Event-spam inflation / DoS; API-key brute-forcing (compounded by weak RNG). Fix: Apply the existing rate-limit.ts to these routes.