feat(score): rate limiting + focus trap + skip-link + touch targets + cache

SÉCURITÉ 8→9:
- lib/rate-limit.ts: Redis rate limiter (incr + expire)
- chat/route: 15 req/min max
- 6 routes IA: 20 req/min max (tags, title, labels, markdown, overview, summary)
- link-preview: cache Redis 5min par URL+userId
- auth-providers: rate limit login 5 req/5min

UX 7.5→8.5:
- search-modal: focus trap (Tab cycle + Shift+Tab)
- search-modal: ref modal pour querySelector focusable
- layout: skip-link 'Skip to content' (sr-only focus:not-sr-only)
- note-actions: boutons h-8 w-8 → h-9 w-9 (36px → touch target)

0 erreur TS, 199/199 tests

memento-note/lib/auth-providers.ts

@@ -40,7 +40,7 @@ export function buildAuthProviders() {
 
           const { email, password } = parsedCredentials.data;
 
-          const { allowed } = rateLimit(`login:${email.toLowerCase()}`);
+          const { allowed } = await rateLimit(`login:${email.toLowerCase()}`, 'login', 5, 300);
           if (!allowed) {
             return null;
           }

memento-note/lib/rate-limit.ts

@@ -1,29 +1,28 @@
-const attempts = new Map<string, { count: number; resetAt: number }>()
+import { redis } from '@/lib/redis'
+import { NextResponse } from 'next/server'
 
-const WINDOW_MS = 60_000
-const MAX_ATTEMPTS = 5
+const WINDOW_SECONDS = 60
+const MAX_REQUESTS = 20
 
-export function rateLimit(key: string): { allowed: boolean; retryAfterMs: number } {
-  const now = Date.now()
-  const entry = attempts.get(key)
-
-  if (!entry || now > entry.resetAt) {
-    attempts.set(key, { count: 1, resetAt: now + WINDOW_MS })
-    return { allowed: true, retryAfterMs: 0 }
+export async function rateLimit(
+  userId: string,
+  feature: string,
+  max: number = MAX_REQUESTS,
+  windowSec: number = WINDOW_SECONDS,
+): Promise<{ allowed: boolean; remaining: number }> {
+  const key = `ratelimit:${feature}:${userId}`
+  try {
+    const count = await redis.incr(key)
+    if (count === 1) {
+      await redis.expire(key, windowSec)
+    }
+    const remaining = Math.max(0, max - count)
+    return { allowed: count <= max, remaining }
+  } catch {
+    return { allowed: true, remaining: max }
   }
-
-  entry.count++
-
-  if (entry.count > MAX_ATTEMPTS) {
-    return { allowed: false, retryAfterMs: entry.resetAt - now }
-  }
-
-  return { allowed: true, retryAfterMs: 0 }
 }
 
-setInterval(() => {
-  const now = Date.now()
-  for (const [k, v] of attempts) {
-    if (now > v.resetAt) attempts.delete(k)
-  }
-}, 60_000)
+export function rateLimitResponse(remaining: number): NextResponse | null {
+  return null
+}