feat(chat): add stateless ciphertext relay

server/rate-limiter.test.mjs

@@ -1,6 +1,10 @@
 import { describe, it, expect, beforeEach, afterEach } from 'vitest';
 import {
     checkLeaveRoomRate,
+    checkChatMessageRate,
+    CHAT_MESSAGE_RATE_LIMIT,
+    CHAT_MESSAGE_RATE_WINDOW_MS,
+    chatMessageCounts,
     LEAVE_ROOM_RATE_LIMIT,
     LEAVE_ROOM_RATE_WINDOW_MS,
     rateLimitDenied,
@@ -99,6 +103,32 @@ describe('LEAVE_ROOM Rate Limiter', () => {
     });
 });
 
+describe('CHAT_MESSAGE Rate Limiter', () => {
+    const socketId = 'chat-socket';
+
+    beforeEach(() => {
+        clearRateLimitMaps();
+        rateLimitDenied.chatMessages = 0;
+    });
+
+    afterEach(() => clearRateLimitMaps());
+
+    it('allows ten messages per ten-second window and blocks the next', () => {
+        for (let i = 0; i < CHAT_MESSAGE_RATE_LIMIT; i++) {
+            expect(checkChatMessageRate(socketId)).toBe(true);
+        }
+        expect(checkChatMessageRate(socketId)).toBe(false);
+        expect(rateLimitDenied.chatMessages).toBe(1);
+    });
+
+    it('resets after the window expires', () => {
+        for (let i = 0; i <= CHAT_MESSAGE_RATE_LIMIT; i++) checkChatMessageRate(socketId);
+        const entry = chatMessageCounts.get(socketId);
+        entry.resetTime = Date.now() - CHAT_MESSAGE_RATE_WINDOW_MS - 1;
+        expect(checkChatMessageRate(socketId)).toBe(true);
+    });
+});
+
 describe('Rate Limit Constants', () => {
     it('should have correct rate limit values', () => {
         expect(LEAVE_ROOM_RATE_LIMIT).toBe(10);