rateLimits table rows are never pruned

**Severity:** Low `src/server/rateLimit.ts` accumulates per-IP/per-email/per-user keys in D1 with no cleanup. Each key self-resets its window so stale rows are harmless — just unbounded row growth over time. **Fix** Add a periodic sweep of expired windows (`DELETE WHERE resetAt < now`), e.g. via a Cloudflare Cron Trigger. **Acceptance:** expired rate-limit rows are cleaned up on a schedule.