chore: sync in-progress work across marketing, admin, API and tests

Snapshot of uncommitted work that had accumulated in the tree alongside
the Turnstile changes:

- marketing pages, SEO helpers (lib/seo.ts, lib/marketing/) and
  structured data
- admin billing actions and a per-user portfolio view, plus an admin
  error boundary
- rate limiting (lib/rate-limit.ts) applied across the /api/v1 surface
- CSP and proxy adjustments, accounting/webhook lib updates
- Playwright config and an e2e/unit test suite
- next bumped to ^16.3.4 with the lockfile regenerated
- generated AGENTS.md / CLAUDE.md

Authored by other sessions working in this tree; committed here so the
Turnstile work could be pushed without leaving the tree dirty.
Typecheck passes.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

app/api/maintenance/route.ts

@@ -8,6 +8,7 @@ import { ownsProperty, ownsUnit, ownsTenant } from "@/lib/db/ownership"
 import { logActivity } from "@/lib/activity"
 import { getEffectiveOwnerId, getAccountContext } from "@/lib/account"
 import { emitWebhookEvent } from "@/lib/webhooks/emit"
+import { enforceRateLimit, clientIp } from "@/lib/rate-limit"
 
 const VALID_STATUSES = ["open", "in_progress", "resolved", "closed"]
 const VALID_PRIORITIES = ["low", "medium", "high", "emergency"]
@@ -62,12 +63,22 @@ export async function POST(request: Request) {
     if (!ctx.canWrite) return NextResponse.json({ error: "Forbidden" }, { status: 403 })
     userId = ctx.ownerId
   } else {
-    // Tenant portal submission — verify portal_token
+    // Tenant portal submission — verify portal_token.
+    //
+    // This is the one unauthenticated write path in the app, so it carries its
+    // own limits: a per-IP budget that also caps portal-token guessing, and a
+    // tighter per-token budget so a leaked token cannot flood a landlord's queue.
+    const ipLimited = enforceRateLimit(`portal-maintenance-ip:${clientIp(request)}`, 20, 3600)
+    if (ipLimited) return ipLimited
+
     const portalToken = body.portal_token as string | undefined
     if (!portalToken) {
       return NextResponse.json({ error: "Unauthorized" }, { status: 401 })
     }
 
+    const tokenLimited = enforceRateLimit(`portal-maintenance:${portalToken}`, 10, 3600)
+    if (tokenLimited) return tokenLimited
+
     const tenant = await db.query.tenants.findFirst({
       where: eq(tenants.portal_token, portalToken),
       columns: { id: true, user_id: true, property_id: true, unit_id: true },