chore(history): squash 67 commit(s) from 2026-09-25

- feat(accounts): persist device links with opaque hashed tokens, list and revoke endpoints
- feat(frontend): app shell, routing and landing page with the chat-command hero
- feat(frontend): Cyrillic-first fonts (Unbounded, Onest, JetBrains Mono); add i18next and motion
- docs: free mod, bilingual site, one-click download, theme editor, public profiles, rich landing in plans
- feat(accounts): internal gRPC AuthenticateDevice guarded by internal key
- feat(frontend): ru/en i18n with typed per-feature dictionaries and language switch
- feat(accounts): GET /me profile endpoint
- feat(gateway): scaffold crate with config validation and health check
- feat(gateway): reverse proxy to accounts and configs services
- feat(gateway): resolve identity once from access JWT or device token via gRPC
- feat(gateway): per-route and global rate limits with Retry-After
- feat(gateway): CORS for the site origin; docs for gateway and internal contract
- feat(configs): scaffold service with schema, config validation and health check
- feat(configs): four config slots per account with list, get and save
- feat(configs): permanent share codes with regenerate and public load-by-code
- feat(accounts): GetPublicProfiles gRPC for showcase author info
- style(accounts,common): apply rustfmt to existing sources
- feat(configs): public showcase with publish, browse, detail and copy-to-slot
- feat(backend): public profile endpoint and showcase author filter
- fix(gateway): silence clippy collapsible-if and needless-ref warnings
- docs(backend): configs-service implemented; Подсистема 1 backend complete
- feat(mod): add Optimize module skeleton with OptimizeState holder
- feat(mod): gate glass blur behind Optimize no_glass knob
- feat(mod): cut MotionBlur and DoF sample counts behind lite_post knob
- feat(mod): trim procedural sky noise behind lite_sky knob
- feat(mod): drop fade gradients and digit rolls behind lean_hud knob
- docs(todo): mark Optimize module phase 9.2 complete
- refactor(mod): drop dead Renderer2D compatibility shims
- refactor(mod): prune unreachable Renderer2D overload towers
- refactor(mod): remove unused Renderer2D overloads and imports
- docs(todo): mark Renderer2D giant-splitting done (2179 to 1597)
- refactor(mod): extract shader id constants from LoVisualRenderPipelines
- docs(todo): record registry wave 2026-09-25 (Renderer2D, pipelines)
- refactor(mod): move Renderer2D instance state into base class
- refactor(mod): extract Renderer2DRounded drawing family
- refactor(mod): extract Renderer2DPath connector and chamfer family
- refactor(mod): extract Renderer2DShapes circle line and texture primitives
- refactor(mod): extract Renderer2DGlass and Renderer2DItem families
- refactor(mod): prune Renderer2D imports after facade split
- docs(todo): record Renderer2D facade inheritance split (1597 to 475)
- docs: easter eggs — .env honeypot, konami troll mode, devtools banner, IDDQD config, breakable 404 block, 418 teapot
- feat(mod): introduce surface style system core (SurfaceStyle, StyleSpec, StyleConfig, SurfaceRenderer)
- refactor(mod): delegate HudRenderUtil liquid glass draws to SurfaceRenderer (dedupe glass constants)
- refactor(mod): route bespoke glass call sites through SurfaceRenderer.plateSpec
- feat(mod): add Auto option to HUD bg effects via shared HudBgStyles resolution
- feat(mod): flat fallback for no-glass optimize mode and persist global HUD config
- feat(mod): default HUD bg effects to Auto so the global surface style drives widgets
- feat(mod): add global cycle-style hotkey with surface style notification
- feat(mod): add surface style swatch strip under the global style picker
- feat(gateway): reject ambiguous paths and answer .env probes with a honeypot
- fix(gateway): charge failed credentials against the rate limit, allow stale ones on /auth
- feat(frontend): ClickGui theme pipeline generated from the mod, live site theming
- feat(frontend): landing v2 hero — voxel/particle backdrop, live ClickGui, theme strip
- docs(todo): drop the FPS A/B measurement from phase 9.3, close phase 9
- feat(gateway): answer /coffee with a 418 teapot
- feat(frontend): land the rest of landing v2 — HUD, module wall, showcase, FAQ, footer
- feat(frontend): one-click download from GitHub releases, changelog page, release CI
- feat(frontend): theme editor with live ClickGui preview, mod-compatible export and share links
- fix(frontend): landing HUD playground now shows real mod widgets (fps, coordinates, module list, keybinds, ping)
- style(frontend): apply ClickGui glass effect to landing HUD playground widgets
- fix(frontend): prevent color field row overflow in theme editor grid
- fix(frontend): never attach stale bearer token to /auth/* requests
- fix(configs): unpublish/publish can no longer bypass moderation
- refactor(accounts): shrink auth/handlers.rs under the 250-line cap
- fix(accounts): tolerate concurrent refresh without killing every session
- fix(gateway): minor hardening from the backend review
- feat(configs): IDDQD easter egg config

backend/gateway/src/rate_limit/mod.rs

@@ -0,0 +1,111 @@
+pub mod rules;
+
+use crate::identity::Identity;
+use axum::{
+    Json,
+    extract::{ConnectInfo, Request, State},
+    http::{HeaderValue, StatusCode, header::RETRY_AFTER},
+    middleware::Next,
+    response::{IntoResponse, Response},
+};
+use governor::{
+    DefaultKeyedRateLimiter, RateLimiter,
+    clock::{Clock, DefaultClock},
+};
+use rules::{KeyBy, Rule};
+use serde_json::json;
+use std::{net::SocketAddr, sync::Arc};
+
+pub struct RateLimits {
+    rules: Vec<(Rule, DefaultKeyedRateLimiter<String>)>,
+    global: DefaultKeyedRateLimiter<String>,
+    trust_proxy: bool,
+    clock: DefaultClock,
+}
+
+impl RateLimits {
+    pub fn new(trust_proxy: bool) -> Arc<Self> {
+        Arc::new(RateLimits {
+            rules: rules::rules()
+                .into_iter()
+                .map(|r| {
+                    let l = RateLimiter::keyed(r.quota);
+                    (r, l)
+                })
+                .collect(),
+            global: RateLimiter::keyed(rules::global_quota()),
+            trust_proxy,
+            clock: DefaultClock::default(),
+        })
+    }
+
+    /// Drops idle keys so the maps don't grow forever. Call periodically.
+    pub fn purge(&self) {
+        for (_, limiter) in &self.rules {
+            limiter.retain_recent();
+            limiter.shrink_to_fit();
+        }
+        self.global.retain_recent();
+        self.global.shrink_to_fit();
+    }
+
+    fn client_ip(&self, req: &Request) -> String {
+        client_ip(req, self.trust_proxy)
+    }
+}
+
+/// The caller's IP: the rightmost X-Forwarded-For entry (the one our own
+/// proxy appended) when `trust_proxy`, else the socket peer.
+pub fn client_ip(req: &Request, trust_proxy: bool) -> String {
+    if trust_proxy
+        && let Some(ip) = req
+            .headers()
+            .get("x-forwarded-for")
+            .and_then(|v| v.to_str().ok())
+            .and_then(|v| v.rsplit(',').next())
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+    {
+        return ip.to_owned();
+    }
+    req.extensions()
+        .get::<ConnectInfo<SocketAddr>>()
+        .map_or_else(|| "unknown".to_owned(), |c| c.0.ip().to_string())
+}
+
+fn too_many(wait: std::time::Duration) -> Response {
+    let secs = wait.as_secs_f64().ceil().max(1.0) as u64;
+    let mut res = (
+        StatusCode::TOO_MANY_REQUESTS,
+        Json(json!({ "error": "too many requests" })),
+    )
+        .into_response();
+    res.headers_mut()
+        .insert(RETRY_AFTER, HeaderValue::from(secs));
+    res
+}
+
+pub async fn enforce(State(limits): State<Arc<RateLimits>>, req: Request, next: Next) -> Response {
+    let ip_key = format!("ip:{}", limits.client_ip(&req));
+    let account_key = req
+        .extensions()
+        .get::<Identity>()
+        .and_then(|i| i.0)
+        .map(|id| format!("acc:{id}"));
+    let caller_key = account_key.unwrap_or_else(|| ip_key.clone());
+
+    let (method, path) = (req.method().clone(), req.uri().path().to_owned());
+    if let Some((rule, limiter)) = limits.rules.iter().find(|(r, _)| r.matches(&method, &path)) {
+        let key = match rule.key_by {
+            KeyBy::Ip => &ip_key,
+            KeyBy::Account => &caller_key,
+        };
+        if let Err(not_until) = limiter.check_key(key) {
+            return too_many(not_until.wait_time_from(limits.clock.now()));
+        }
+    }
+    if let Err(not_until) = limits.global.check_key(&caller_key) {
+        return too_many(not_until.wait_time_from(limits.clock.now()));
+    }
+    next.run(req).await
+}

backend/gateway/src/rate_limit/rules.rs

@@ -0,0 +1,85 @@
+use axum::http::Method;
+use governor::Quota;
+use std::num::NonZeroU32;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum KeyBy {
+    Ip,
+    Account,
+}
+
+pub struct Rule {
+    pub method: Method,
+    /// Exact path, or a prefix when it ends with '*'.
+    pub pattern: &'static str,
+    pub quota: Quota,
+    pub key_by: KeyBy,
+}
+
+impl Rule {
+    pub fn matches(&self, method: &Method, path: &str) -> bool {
+        if self.method != *method {
+            return false;
+        }
+        match self.pattern.strip_suffix('*') {
+            Some(prefix) => path.starts_with(prefix),
+            None => path == self.pattern,
+        }
+    }
+}
+
+fn n(v: u32) -> NonZeroU32 {
+    NonZeroU32::new(v).expect("rate-limit constants are non-zero")
+}
+
+fn rule(method: Method, pattern: &'static str, quota: Quota, key_by: KeyBy) -> Rule {
+    Rule {
+        method,
+        pattern,
+        quota,
+        key_by,
+    }
+}
+
+pub fn rules() -> Vec<Rule> {
+    use KeyBy::*;
+    vec![
+        rule(Method::POST, "/auth/login", Quota::per_minute(n(5)), Ip),
+        rule(Method::POST, "/auth/register", Quota::per_hour(n(3)), Ip),
+        rule(Method::POST, "/auth/refresh", Quota::per_minute(n(30)), Ip),
+        rule(Method::POST, "/device/code", Quota::per_minute(n(10)), Ip),
+        // The mod polls every 2–3 s for up to 10 min: 10/min would break linking.
+        rule(Method::POST, "/device/token", Quota::per_minute(n(30)), Ip),
+        rule(Method::PUT, "/configs/*", Quota::per_minute(n(20)), Account),
+        rule(
+            Method::GET,
+            "/configs/shared/*",
+            Quota::per_minute(n(30)),
+            Ip,
+        ),
+        rule(Method::POST, "/avatars", Quota::per_hour(n(5)), Account),
+        rule(Method::GET, "/showcase*", Quota::per_minute(n(60)), Ip),
+    ]
+}
+
+pub fn global_quota() -> Quota {
+    Quota::per_minute(n(300))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn exact_and_prefix_matching() {
+        let all = rules();
+        let find = |m: Method, p: &str| all.iter().position(|r| r.matches(&m, p));
+        assert_eq!(find(Method::POST, "/auth/login"), Some(0));
+        assert_eq!(find(Method::GET, "/auth/login"), None);
+        assert_eq!(find(Method::POST, "/auth/login/x"), None);
+        assert!(find(Method::PUT, "/configs/3").is_some());
+        assert!(find(Method::GET, "/configs/shared/ABCD").is_some());
+        assert!(find(Method::GET, "/showcase").is_some());
+        assert!(find(Method::GET, "/showcase/11111111-1111-1111-1111-111111111111").is_some());
+    }
+}