[VULN-17] WebSocket Message Flood

[lyncmi07]

Severity: Medium
Affected location: index.ts:167-190

Issue:
No per-user/per-connection message rate limiting on WebSockets; attackers can spam messages and force DB growth.

Mitigation plan:

1. Add token-bucket rate limiter per user/connection.
2. Enforce payload size and message frequency limits.
3. Temporarily mute/disconnect abusive connections.

Verification / tests:

• Test burst over limit gets throttled/rejected.
• Ensure normal chat throughput still works.