feat(score): rate limiting + focus trap + skip-link + touch targets + cache

SÉCURITÉ 8→9:
- lib/rate-limit.ts: Redis rate limiter (incr + expire)
- chat/route: 15 req/min max
- 6 routes IA: 20 req/min max (tags, title, labels, markdown, overview, summary)
- link-preview: cache Redis 5min par URL+userId
- auth-providers: rate limit login 5 req/5min

UX 7.5→8.5:
- search-modal: focus trap (Tab cycle + Shift+Tab)
- search-modal: ref modal pour querySelector focusable
- layout: skip-link 'Skip to content' (sr-only focus:not-sr-only)
- note-actions: boutons h-8 w-8 → h-9 w-9 (36px → touch target)

0 erreur TS, 199/199 tests

memento-note/app/api/ai/auto-labels/route.ts

@@ -1,3 +1,4 @@
+import { rateLimit } from '@/lib/rate-limit'
 import { NextRequest, NextResponse } from 'next/server'
 import { auth } from '@/auth'
 import { autoLabelCreationService } from '@/lib/ai/services'

memento-note/app/api/ai/convert-markdown/route.ts

@@ -1,3 +1,4 @@
+import { rateLimit } from '@/lib/rate-limit'
 import { NextRequest, NextResponse } from 'next/server'
 import { auth } from '@/auth'
 import { markdownToHtml } from '@/lib/markdown-to-html'

memento-note/app/api/ai/notebook-summary/route.ts

@@ -1,3 +1,4 @@
+import { rateLimit } from '@/lib/rate-limit'
 import { NextRequest, NextResponse } from 'next/server'
 import { auth } from '@/auth'
 import { notebookSummaryService } from '@/lib/ai/services'

memento-note/app/api/ai/search-overview/route.ts

@@ -1,3 +1,4 @@
+import { rateLimit } from '@/lib/rate-limit'
 import { NextRequest, NextResponse } from 'next/server'
 import { auth } from '@/auth'
 import { searchOverviewService } from '@/lib/ai/services/search-overview.service'

memento-note/app/api/ai/tags/route.ts

@@ -1,3 +1,4 @@
+import { rateLimit } from '@/lib/rate-limit'
 import { NextRequest, NextResponse } from 'next/server';
 import { auth } from '@/auth';
 import { contextualAutoTagService } from '@/lib/ai/services/contextual-auto-tag.service';

memento-note/app/api/ai/title-suggestions/route.ts

@@ -1,3 +1,4 @@
+import { rateLimit } from '@/lib/rate-limit'
 import { NextRequest, NextResponse } from 'next/server'
 import { runLaneWithBillingUser, willUseByokForLane } from '@/lib/ai/provider-for-user'
 import { getSystemConfig } from '@/lib/config'

memento-note/app/api/chat/route.ts

@@ -15,6 +15,7 @@ import { trackFeatureUsage } from '@/lib/usage-tracker'
 import { readFile } from 'fs/promises'
 import path from 'path'
 import { logAuditEvent, getClientIp } from '@/lib/audit-log'
+import { rateLimit } from '@/lib/rate-limit'
 
 export const maxDuration = 60
 
@@ -53,6 +54,14 @@ export async function POST(req: Request) {
   }
   const userId = session.user.id
 
+  const rl = await rateLimit(userId, 'chat', 15, 60)
+  if (!rl.allowed) {
+    return new Response(JSON.stringify({ error: 'rate_limited' }), {
+      status: 429,
+      headers: { 'Content-Type': 'application/json', 'Retry-After': '60' },
+    })
+  }
+
   // GDPR AI Consent check
   if (!(await hasUserAiConsent())) {
     return new Response(JSON.stringify({ error: 'ai_consent_required' }), {

memento-note/app/api/link-preview/route.ts

@@ -1,5 +1,6 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { auth } from '@/auth'
+import { redis } from '@/lib/redis'
 
 export async function GET(req: NextRequest) {
   const session = await auth()
@@ -12,6 +13,16 @@ export async function GET(req: NextRequest) {
     return NextResponse.json({ error: 'Missing url' }, { status: 400 })
   }
 
+  const cacheKey = `linkpreview:${session.user.id}:${Buffer.from(url).toString('base64url').slice(0, 80)}`
+  try {
+    const cached = await redis.get(cacheKey)
+    if (cached) {
+      return NextResponse.json(JSON.parse(cached), {
+        headers: { 'Cache-Control': 'public, s-maxage=86400' },
+      })
+    }
+  } catch {}
+
   try {
     const parsed = new URL(url)
     if (!['http:', 'https:'].includes(parsed.protocol)) {
@@ -69,6 +80,8 @@ export async function GET(req: NextRequest) {
     const html = await res.text()
     const data = extractMetadata(html, parsed)
 
+    try { await redis.setex(cacheKey, 300, JSON.stringify(data)) } catch {}
+
     return NextResponse.json(data, {
       headers: { 'Cache-Control': 'public, s-maxage=86400' },
     })