9.1 Replace in-memory Map with Upstash Redis.
9.2 Use the @edge-rate-limiter/vercel helper with a 60 req / min policy per userId + IP.
9.3 Parse real client IP via get-ip handling IPv6 and proxy chains.
9.4 Harden regex for open routes (e.g., ^/(sign-in|sign-up)(/|$)).
9.5 Add unit tests simulating IPv4, IPv6, and Cloudflare headers.
9.1 Replace in-memory Map with Upstash Redis.
9.2 Use the @edge-rate-limiter/vercel helper with a 60 req / min policy per userId + IP.
9.3 Parse real client IP via get-ip handling IPv6 and proxy chains.
9.4 Harden regex for open routes (e.g., ^/(sign-in|sign-up)(/|$)).
9.5 Add unit tests simulating IPv4, IPv6, and Cloudflare headers.