feat(api): add send payload limits and per-tenant rate limiting

[patoperpetua]

Summary

• Reject oversized POST /emails/send bodies and variables before template load with stable PAYLOAD_TOO_LARGE errors and configurable byte limits.
• Add per-tenant sliding-window rate limiting keyed on {tenantId}:{environment}, returning 429 with Retry-After and RATE_LIMITED.
• Generalise the existing in-memory SlidingWindowRateLimiter for send traffic; document the best-effort / scale-out limitation and new env defaults in .env.example.

Test plan

• pnpm test in apps/api (send-limits unit tests, send handler size/rate-limit tests, security boundary updates)
• Oversized body rejected before template store access
• Oversized variable values rejected with limit named in message
• Per-tenant rate limit isolation verified
• 429 response includes Retry-After and RATE_LIMITED code

Closes #38

Made with Cursor

[coderabbitai]

Warning

Review limit reached

Next included review available in 7 minutes.

View limit details

Limit details: You’ve used all 10 included reviews currently available.

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f9892986-07c7-4ad7-b1b9-9cc314751425

📥 Commits

Reviewing files that changed from the base of the PR and between a2dfa4e and db0fbf0.

📒 Files selected for processing (10)

• .env.example
• apps/api/src/config/app-configuration.ts
• apps/api/src/contact-rate-limit.ts
• apps/api/src/functions/send.security.spec.ts
• apps/api/src/functions/send.spec.ts
• apps/api/src/functions/send.ts
• apps/api/src/send-limits.spec.ts
• apps/api/src/send-limits.ts
• packages/post-kit-types/src/index.spec.ts
• packages/post-kit-types/src/send.ts

---

_{Comment @coderabbitai help to get the list of available commands.}