fix: 修复在线更新暂存链路并增加全局 API 限流备底

- 新增 server/rate-limit.ts：进程内固定窗口限流器，无数据库写入
- server/app.ts 注册全局 preHandler，仅作用于 /api/*，超限返回 429 与 Retry-After
- 提取 isApiPath 统一 onSend、preHandler 与 404 的路径判断
- 更新任务冲突判定改用 ACTIVE_UPDATE_CONFLICT_SQL，staged/download 产物不再阻塞新任务
- cancelUpdateJob 调用补上 await，避免结果恒为 pending Promise
- server/cli/update.ts 增加特权工作区所有权校验与暂存路径重建逻辑
- 新增 tests/rate-limit.test.ts 与 tests/update-apply-staging.test.ts

tests/e2e/smoke.spec.ts

@@ -1,8 +1,12 @@
 import { expect, test } from "@playwright/test";
 
+// Keep the expected copy in one place so a product-wide copy refresh cannot
+// silently desynchronise this suite from web-next/src/pages/auth/LoginPage.tsx.
+const LOGIN_HEADING = "登录 TallyNote 工作台";
+
 test("未登录时显示中文登录入口", async ({ page }) => {
   await page.goto("/");
-  await expect(page.getByRole("heading", { name: "登录到 TallyNote", exact: true })).toBeVisible();
+  await expect(page.getByRole("heading", { name: LOGIN_HEADING, exact: true })).toBeVisible();
   await expect(page.locator(".tn-login-header")).toHaveCount(0);
   await expect(page.getByLabel("用户名", { exact: true })).toBeVisible();
   await expect(page.getByLabel("密码", { exact: true })).toBeVisible();
@@ -17,7 +21,7 @@ for (const viewport of [
   test(`未登录入口适配 ${viewport.width}px`, async ({ page }) => {
     await page.setViewportSize(viewport);
     await page.goto("/");
-    await expect(page.getByRole("heading", { name: "登录到 TallyNote", exact: true })).toBeVisible();
+    await expect(page.getByRole("heading", { name: LOGIN_HEADING, exact: true })).toBeVisible();
     await expect(page.getByLabel("用户名", { exact: true })).toBeVisible();
     await expect(page.getByLabel("密码", { exact: true })).toBeVisible();
     await expect(page.getByRole("button", { name: "登录" })).toBeVisible();