perf: optimize monitor runner, fix SSE leak, deduplicate shared utils

apps/web/src/routes/auth.ts

@@ -1,29 +1,12 @@
 import { Elysia, t } from "elysia";
 import { createHmac, randomBytes } from "crypto";
 import sql from "../db";
+import { createRateLimiter } from "../utils/rate-limit";
 
 const EMAIL_HMAC_KEY = process.env.EMAIL_HMAC_KEY || "pingql-default-hmac-key";
 
 // ── Per-IP rate limiting for auth endpoints ───────────────────────────
-const authRateMap = new Map<string, { count: number; resetAt: number }>();
-
-function checkAuthRateLimit(ip: string, maxPerMinute: number): boolean {
-  const now = Date.now();
-  const entry = authRateMap.get(ip);
-  if (!entry || now > entry.resetAt) {
-    authRateMap.set(ip, { count: 1, resetAt: now + 60_000 });
-    return true;
-  }
-  entry.count++;
-  return entry.count <= maxPerMinute;
-}
-
-setInterval(() => {
-  const now = Date.now();
-  for (const [key, entry] of authRateMap) {
-    if (now > entry.resetAt) authRateMap.delete(key);
-  }
-}, 5 * 60_000);
+const checkAuthRateLimit = createRateLimiter();
 
 function generateKey(): string {
   return randomBytes(32).toString("base64url");