feat(node): per-IP write-surface rate brake + purge-spam admin tool

.env.example

@@ -365,6 +365,24 @@ GITLAWB_RATE_LIMIT_MAX=10
 # limiter. Default 3600.
 GITLAWB_RATE_LIMIT_WINDOW_SECS=3600
 
+# ── Write rate limiting (non-creation authenticated writes) ───────────────
+# Max requests per client IP per hour on the shared write bucket. It is debited
+# by: issue and PR comments, issue close, labels, stars, merges, protect and
+# unprotect, replicas, webhook create/delete, visibility (including the GET on
+# that group), tasks, bounties, profile, and every HTTP request to /graphql.
+# The /graphql brake wraps the whole route, so queries and the playground GET
+# consume this bucket too, not only mutations (GraphQL WebSocket subscriptions
+# are excluded). Issue comment and issue close debit it inside the handler,
+# after the read gate, rather than in router middleware. Issue close also draws
+# on its own GITLAWB_CLOSE_ISSUE_RATE_LIMIT bucket, and a close refused by
+# either cap spends nothing from the other. Separate from the creation and push
+# brakes. Uses GITLAWB_TRUSTED_PROXY to resolve the client IP.
+# NOTE: this is a per-IP aggregate across ALL those write actions, so behind a
+# shared NAT/egress IP (or with GITLAWB_TRUSTED_PROXY unset) many users collapse
+# onto one bucket — raise this for automation-heavy or multi-user single-IP
+# deployments. 0 disables. Default 600.
+GITLAWB_WRITE_RATE_LIMIT=600
+
 # ── Peer-sync rate limiting (per client IP, uses GITLAWB_TRUSTED_PROXY below) ─
 # /api/v1/peers/announce and /api/v1/sync/notify accept unsigned requests from
 # known peers and run at higher frequency, so a generous bucket. Separate from

crates/gitlawb-node/Cargo.toml

@@ -30,6 +30,7 @@ required-features = ["test-harness"]
 
 [dependencies]
 gitlawb-core = { path = "../gitlawb-core" }
+async-trait = "0.1"
 ed25519-dalek = { workspace = true }
 base64 = { workspace = true }
 tokio = { workspace = true }