fix(insights): cache hits no longer burn rate-limit tokens

P13. Move `checkRateLimit` below the 24h cache-return path so a request
that gets served from the cached `insightsCachedText` never consumes one
of the 2/hour LLM-generation tokens. A user reloading the dashboard a
few times no longer locks themselves out of a fresh refresh for an hour.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/app/api/insights/generate/route.ts

@@ -15,11 +15,6 @@ export const POST = apiHandler(async (request: NextRequest) => {
   const { user } = await requireAuth();
   const userId = user.id;
 
-  const rl = await checkRateLimit(`insights:${userId}`, 2, 60 * 60 * 1000);
-  if (!rl.allowed) {
-    return apiError("Maximum 2 insight generations per hour.", 429);
-  }
-
   const dbUser = await prisma.user.findUnique({
     where: { id: userId },
     select: {
@@ -53,6 +48,15 @@ export const POST = apiHandler(async (request: NextRequest) => {
     }
   }
 
+  // P13: rate-limit check moved BELOW the cache return so a hit on the
+  // 24h cache never burns one of the 2/hour LLM-generation tokens.
+  // Otherwise a noisy reload loop on the dashboard would lock out real
+  // refreshes for an hour for no benefit.
+  const rl = await checkRateLimit(`insights:${userId}`, 2, 60 * 60 * 1000);
+  if (!rl.allowed) {
+    return apiError("Maximum 2 insight generations per hour.", 429);
+  }
+
   const provider = await resolveProvider(userId);
 
   if (provider.type === "none") {