feat: add rate limiting to all API endpoints (not just payment)

[oche11207-art]

Summary

Closes #275

Changes

• Added EndpointType enum (READ / WRITE) to shared types
• Configured endpoint-type multipliers: READ = 3x, WRITE = 1x tier limits
• Updated TieredRateLimiter middleware to accept endpoint type options
  • Auto-detects from HTTP method: GET/HEAD/OPTIONS → READ, everything else → WRITE
  • Added X-RateLimit-Type response header
• Applied rate limiting globally to all /api routes in server.ts

Acceptance Criteria

• Apply tiered rate limiting to all API endpoints
• Configure different rate limits per endpoint type (read vs write)
• Add rate limit headers to all responses
• All tests pass (257/263 passing; 6 failures are pre-existing)

Test Results

• TypeScript typecheck: ✅ passed
• Backend tests: 257/263 passing (6 failures are pre-existing)
• Rate limiter tests: 16/16 passing

Files Changed

• shared/types.ts — Added EndpointType enum
• backend/src/config/rateLimits.ts — Added endpoint type multipliers
• backend/src/middleware/rateLimiter.ts — Updated middleware with endpoint type support
• backend/src/types/userTier.ts — Re-exported EndpointType
• backend/src/server.ts — Applied global rate limiting to /api routes