Move 6 rate-limit functions, all rate-limit Maps, cleanup intervals, and denial counter to server/rate-limiter.js. 149 lines extracted. Index.js re-exports what tests and ops.js need. npm run verify passes.
Timo