Add rate limiting per user (not just per IP)

[Mystery-CLI]

🔧 Title: Add rate limiting per user (not just per IP)

📘 Description
The current rate limiter is IP-based. Authenticated users behind a shared IP (corporate NAT, VPN) share the same rate limit bucket. High-volume legitimate users can be blocked by a single bad actor on the same IP. Per-user rate limiting is more accurate.

✅ Acceptance Criteria

• Add a per-user rate limiter that uses req.user.id as the key for authenticated routes
• Apply stricter per-user limits to payment endpoints (10 payments/minute)
• Keep IP-based limiting for unauthenticated routes
• Add tests for per-user rate limiting

🔧 Context: backend/src/middleware/rateLimiter.js.

---