fix(api): rate-limit feedback endpoint + drop overly broad cache invalidation (H5/H6 code-review)

H5 — `POST /api/insights/feedback` had no rate limit. The unique
index `(userId, recommendationId, recommendationText)` blocks exact
replays but a malicious client could distort the daily aggregator's
bucket slice by varying recommendationId/text per request. Added
`checkRateLimit("insights-feedback:<user.id>", 60, 60 * 60 * 1000)`.
60/h is generous given a comprehensive insight rarely has >10 recs.

H6 — `<RecommendationFeedback>` invalidated the entire `["insights"]`
prefix on every thumbs click, which matches all 8 insights queries
(comprehensive + 7 per-status). None of them depend on the feedback
row. The 24h server cache absorbs the actual LLM round-trip but the
network thrash + stale-cache refetch was waste. Dropped the
invalidation; user-visible verdict state lives in localStorage +
local React state. v1.4.17's prompt-version ratchet will scope its
own invalidation when feedback feeds the next generation.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/components/insights/recommendation-feedback.tsx

@@ -27,7 +27,7 @@
  */
 
 import { useMemo, useState } from "react";
-import { useMutation, useQueryClient } from "@tanstack/react-query";
+import { useMutation } from "@tanstack/react-query";
 import { ThumbsUp, ThumbsDown, Loader2, Check } from "lucide-react";
 import { useTranslations } from "@/lib/i18n/context";
 import { useAuth } from "@/hooks/use-auth";
@@ -132,7 +132,6 @@ export function RecommendationFeedback({
 }: RecommendationFeedbackProps) {
   const { t } = useTranslations();
   const { user } = useAuth();
-  const queryClient = useQueryClient();
 
   const [state, setState] = useState<FeedbackState>(() => {
     if (initialState) return initialState;
@@ -189,7 +188,13 @@ export function RecommendationFeedback({
       const verdict = result.helpful ? "up" : "down";
       writeLocalState(user.id, recId, recText, verdict);
       setState(`submitted-${verdict}` as const);
-      queryClient.invalidateQueries({ queryKey: ["insights"] });
+      // v1.4.16 phase D reconcile (code-review H6) — feedback doesn't
+      // affect the displayed insight content, so invalidating the entire
+      // ["insights"] tree (8 queries: comprehensive + 7 per-status)
+      // would force expensive refetches on a stale cache. The user-
+      // visible state lives in localStorage + the local React state
+      // above. The v1.4.17 ratchet that consumes feedback into the
+      // next generation will scope its own invalidation.
     },
     onError: () => {
       // Optimistic-rollback: drop back to default so the user can