add rate limiting to inbox (10/min per sender)

src/pds.js

···
         did TEXT PRIMARY KEY
       );
 
+      CREATE TABLE IF NOT EXISTS inbox_rate_limit (
+        fromDid TEXT NOT NULL,
+        sentAt TEXT NOT NULL
+      );
+
       CREATE INDEX IF NOT EXISTS idx_inbox_messages_from ON inbox_messages(fromDid);
+      CREATE INDEX IF NOT EXISTS idx_inbox_rate_limit_from ON inbox_rate_limit(fromDid, sentAt);
     `);
   }
 
···
     const now = new Date().toISOString();
 
     if (accepted.length > 0) {
-      // Deliver directly to inbox
+      // Rate limit: max 10 messages per minute per sender
+      const cutoff = new Date(Date.now() - 60 * 1000).toISOString();
+
+      // Clean up old rate limit entries
+      this.sql.exec('DELETE FROM inbox_rate_limit WHERE sentAt < ?', cutoff);
+
+      // Count recent messages from this sender
+      const recentCount = this.sql
+        .exec('SELECT COUNT(*) as cnt FROM inbox_rate_limit WHERE fromDid = ? AND sentAt >= ?', senderDid, cutoff)
+        .toArray()[0].cnt;
+
+      if (recentCount >= 10) {
+        return Response.json({ status: 'rate_limited' });
+      }
+
+      // Record this message for rate limiting
+      this.sql.exec('INSERT INTO inbox_rate_limit (fromDid, sentAt) VALUES (?, ?)', senderDid, now);
+
+      // Deliver to inbox
       this.sql.exec(
         'INSERT INTO inbox_messages (fromDid, text, createdAt) VALUES (?, ?, ?)',
         senderDid,