test(api): use the real caps in the limiter mocks, and drop a stale pointer

Three consent-surface tests mocked the shared AI-consent bucket at 60 where it
is 20, and the analytics-read and MCP mocks named 60 against real caps of 120.
Nothing asserts the number today, so nothing was wrong on the wire — but the
mocked verdict now carries `limit` all the way to `X-RateLimit-Limit`, and the
first test that reads that header off a mock would pin the fiction.

The response-shape file's header pointed at a document that is not in the
repo; it says what it means directly instead. It also now records the one
thing the gate cannot see: `meta` is a loose object on purpose, so undeclared
keys inside it survive the parse and the strip comparison does not reach them.

src/app/api/consent/ai/__tests__/route.test.ts

@@ -114,7 +114,7 @@ describe("POST /api/consent/ai", () => {
     vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
     vi.mocked(checkConsentRateLimit).mockResolvedValue({
       allowed: false,
-      limit: 60,
+      limit: 20,
       remaining: 0,
       resetAt: Date.now() + 60_000,
     });

src/app/api/consent/ai/latest/__tests__/route.test.ts

@@ -104,7 +104,7 @@ describe("GET /api/consent/ai/latest", () => {
     vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
     vi.mocked(checkConsentRateLimit).mockResolvedValue({
       allowed: false,
-      limit: 60,
+      limit: 20,
       remaining: 0,
       resetAt: Date.now() + 60_000,
     });
@@ -203,7 +203,7 @@ describe("DELETE /api/consent/ai/latest", () => {
     vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
     vi.mocked(checkConsentRateLimit).mockResolvedValue({
       allowed: false,
-      limit: 60,
+      limit: 20,
       remaining: 0,
       resetAt: Date.now() + 60_000,
     });

src/app/api/consent/ai/web/__tests__/route.test.ts

@@ -84,7 +84,7 @@ describe("POST /api/consent/ai/web", () => {
     vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
     vi.mocked(checkConsentRateLimit).mockResolvedValue({
       allowed: false,
-      limit: 60,
+      limit: 20,
       remaining: 0,
       resetAt: Date.now() + 60_000,
     });

src/app/api/insights/comprehensive/__tests__/route.test.ts

@@ -117,7 +117,7 @@ beforeEach(() => {
   // v1.15.20 — default to an allowing analytics-read budget.
   vi.mocked(checkAnalyticsReadRateLimit).mockResolvedValue({
     allowed: true,
-    limit: 60,
+    limit: 120,
     remaining: 119,
     resetAt: Date.now() + 60_000,
   });

src/app/api/insights/correlations/__tests__/route.test.ts

@@ -103,7 +103,7 @@ beforeEach(() => {
   // v1.15.20 — default to an allowing analytics-read budget.
   vi.mocked(checkAnalyticsReadRateLimit).mockResolvedValue({
     allowed: true,
-    limit: 60,
+    limit: 120,
     remaining: 119,
     resetAt: Date.now() + 60_000,
   });
@@ -230,7 +230,7 @@ describe("GET /api/insights/correlations", () => {
     vi.mocked(getSession).mockResolvedValue(SESSION_OK as never);
     vi.mocked(checkAnalyticsReadRateLimit).mockResolvedValue({
       allowed: false,
-      limit: 60,
+      limit: 120,
       remaining: 0,
       resetAt: Date.now() + 60_000,
     });

src/app/mcp/__tests__/route.test.ts

@@ -156,7 +156,7 @@ beforeEach(() => {
   vi.mocked(isApiGloballyEnabled).mockResolvedValue(true);
   vi.mocked(checkMcpRateLimit).mockResolvedValue({
     allowed: true,
-    limit: 60,
+    limit: 120,
     remaining: 119,
     resetAt: Date.now() + 60_000,
   });
@@ -353,7 +353,7 @@ describe("/mcp — rate limit", () => {
     validToken();
     vi.mocked(checkMcpRateLimit).mockResolvedValue({
       allowed: false,
-      limit: 60,
+      limit: 120,
       remaining: 0,
       resetAt: Date.now() + 30_000,
     });