harden: low-severity bundle (rate-limit, TOCTOU, erasure order, outbox)

[Musiker15]

Bundled low-severity findings from the multi-agent review (PR C — final of the cluster).

Changes

• Export rate-limit — GET /api/submissions/[id]/export now rate-limited (10/min/IP) for parity with withdraw/delete (the UUID is the only credential).
• Withdraw TOCTOU — read + guarded updateMany (status = current) in one transaction; terminal statuses (incl. an existing withdrawal) return 409 instead of racing.
• Erasure order — DELETE removes the row first (cascades events + file rows), so the erasure is durable even if MinIO is down, then best-effort purges the stored objects.
• 0-byte files — Content-Length is set on contentLength !== undefined rather than truthy.
• Outbox poller — each row delivered under its own try/catch (one bad row no longer aborts the batch); delivered rows marked read in a single updateMany. New partial index notifications(created_at) WHERE read_at IS NULL (hand-written migration) keeps the scan cheap as the table grows.
• Upload cap — maxFileSizeMb capped at a hard server ceiling (MAX_FILE_SIZE_MB = 25) in the spec schema and clamped again in the upload route; bounded in-memory buffering documented.
• Cleanup — moved a misplaced doc comment onto the function it describes (deliverOne).

Migration

20260620180000_notification_pending_index — raw CREATE INDEX ... WHERE read_at IS NULL (partial indexes aren't expressible in the Prisma schema). Applied by prisma migrate deploy on deploy.

Validation

pnpm typecheck, pnpm lint, pnpm test, pnpm build — all green.