fix(security): audit batch A — validation, rate limiting, sessions (#20)

src/InboxIntel.Api/Controllers/AiController.cs

@@ -7,6 +7,7 @@ namespace InboxIntel.Api.Controllers;
 /// AI endpoints are read-only / advisory. They never trigger destructive
 /// actions - suggestions are returned for the user to act on via /cleanup.
 /// </summary>
+[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting("expensive")]  // AUDIT H-2: LLM calls are the most expensive path
 public class AiController : ApiControllerBase
 {
     private readonly IAiService _ai;

src/InboxIntel.Api/Controllers/AuthController.cs

@@ -5,10 +5,12 @@ using Microsoft.AspNetCore.Authentication.Cookies;
 using Microsoft.AspNetCore.Authentication.Google;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.RateLimiting;
 
 namespace InboxIntel.Api.Controllers;
 
 [ApiController]
+[EnableRateLimiting("auth")]  // AUDIT H-2: throttle login/challenge attempts per IP
 [ApiVersion("1.0")]
 [Route("api/v{version:apiVersion}/[controller]")]
 public class AuthController : ControllerBase

src/InboxIntel.Api/Controllers/ExportController.cs

@@ -3,6 +3,7 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace InboxIntel.Api.Controllers;
 
+[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting("expensive")]  // AUDIT H-2: PDF/CSV generation is costly
 public class ExportController : ApiControllerBase
 {
     private readonly IExportService _export;

src/InboxIntel.Api/Controllers/UnsubscribeController.cs

@@ -4,6 +4,7 @@ using Microsoft.AspNetCore.Mvc;
 
 namespace InboxIntel.Api.Controllers;
 
+[Microsoft.AspNetCore.RateLimiting.EnableRateLimiting("expensive")]  // AUDIT H-2: triggers server-side outbound HTTP
 public class UnsubscribeController : ApiControllerBase
 {
     private readonly IUnsubscribeService _unsub;