feat(score): rate limiting + focus trap + skip-link + touch targets + cache

SÉCURITÉ 8→9:
- lib/rate-limit.ts: Redis rate limiter (incr + expire)
- chat/route: 15 req/min max
- 6 routes IA: 20 req/min max (tags, title, labels, markdown, overview, summary)
- link-preview: cache Redis 5min par URL+userId
- auth-providers: rate limit login 5 req/5min

UX 7.5→8.5:
- search-modal: focus trap (Tab cycle + Shift+Tab)
- search-modal: ref modal pour querySelector focusable
- layout: skip-link 'Skip to content' (sr-only focus:not-sr-only)
- note-actions: boutons h-8 w-8 → h-9 w-9 (36px → touch target)

0 erreur TS, 199/199 tests

memento-note/lib/auth-providers.ts

@@ -40,7 +40,7 @@ export function buildAuthProviders() {
 
           const { email, password } = parsedCredentials.data;
 
-          const { allowed } = rateLimit(`login:${email.toLowerCase()}`);
+          const { allowed } = await rateLimit(`login:${email.toLowerCase()}`, 'login', 5, 300);
           if (!allowed) {
             return null;
           }