feat(24-01): refactor rateLimit to factory pattern with createRateLimit

- Add createRateLimit(maxAttempts, windowMs) factory function
- Rewrite rateLimit export to delegate to factory (backward compatible)
- Keep shared store, getClientIp, cleanup, and _resetForTesting unchanged
- Add createRateLimit factory test suite with 5 test cases
- All existing rateLimit middleware tests still pass

src/server/middleware/rateLimit.ts

@@ -7,9 +7,6 @@ interface RateLimitEntry {
 
 const store = new Map<string, RateLimitEntry>();
 
-const MAX_ATTEMPTS = 5;
-const WINDOW_MS = 15 * 60 * 1000; // 15 minutes
-
 function getClientIp(c: Context): string {
 	return c.req.header("x-forwarded-for")?.split(",")[0]?.trim() || "unknown";
 }
@@ -23,30 +20,29 @@ function cleanup() {
 	}
 }
 
-export async function rateLimit(c: Context, next: Next) {
-	cleanup();
-
-	const ip = getClientIp(c);
-	const key = `${ip}:${c.req.path}`;
-	const now = Date.now();
-
-	const entry = store.get(key);
-
-	if (!entry || now >= entry.resetAt) {
-		store.set(key, { count: 1, resetAt: now + WINDOW_MS });
+export function createRateLimit(maxAttempts: number, windowMs: number) {
+	return async function rateLimitMiddleware(c: Context, next: Next) {
+		cleanup();
+		const ip = getClientIp(c);
+		const key = `${ip}:${c.req.path}`;
+		const now = Date.now();
+		const entry = store.get(key);
+		if (!entry || now >= entry.resetAt) {
+			store.set(key, { count: 1, resetAt: now + windowMs });
+			return next();
+		}
+		if (entry.count >= maxAttempts) {
+			const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
+			c.header("Retry-After", String(retryAfter));
+			return c.json({ error: "Too many attempts. Try again later." }, 429);
+		}
+		entry.count++;
 		return next();
-	}
-
-	if (entry.count >= MAX_ATTEMPTS) {
-		const retryAfter = Math.ceil((entry.resetAt - now) / 1000);
-		c.header("Retry-After", String(retryAfter));
-		return c.json({ error: "Too many attempts. Try again later." }, 429);
-	}
-
-	entry.count++;
-	return next();
+	};
 }
 
+export const rateLimit = createRateLimit(5, 15 * 60 * 1000);
+
 /** @internal — only for testing */
 export function _resetForTesting() {
 	store.clear();