Fix rate limits, concurrency control, copy button

- DATA-BACKED RATE LIMITS:
  * Reduce global rate limit from 10,000/min to 100/min
  * Add PDF conversion rate limits: 10/min free, 30/min pro
  * Set recovery rate limit to 3/hour (was 5/hour)
  * Add concurrency limiter: max 3 simultaneous PDFs, queue rest
  * Return 429 if queue > 10

- BUG-025: Fix copy button functionality
  * Improve fallback handling for execCommand
  * Add better error handling and user feedback
  * Fix secure context detection

- Add concurrency monitoring endpoint /v1/concurrency

bugs.md

@@ -0,0 +1,24 @@
+# DocFast Bugs
+
+## Open
+
+### BUG-030: Email change backend not implemented
+- **Severity:** High
+- **Found:** 2026-02-14 QA session
+- **Description:** Frontend UI for email change is deployed (modal, form, JS handlers), but no backend routes exist. Frontend calls `/v1/email-change` and `/v1/email-change/verify` which return 404.
+- **Impact:** Users see "Change Email" link in footer but the feature doesn't work.
+- **Fix:** Implement `src/routes/email-change.ts` with verification code flow similar to signup/recover.
+
+### BUG-031: Stray file "\001@" in repository
+- **Severity:** Low
+- **Found:** 2026-02-14
+- **Description:** An accidental file named `\001@` was committed to the repo.
+- **Fix:** `git rm "\001@"` and commit.
+
+### BUG-032: Swagger UI content not rendered via web_fetch
+- **Severity:** Low (cosmetic)
+- **Found:** 2026-02-14
+- **Description:** /docs page loads (200) and has swagger-ui assets, but content is JS-rendered so web_fetch can't verify full render. Needs browser-based QA for full verification.
+
+## Fixed
+(none yet - this is first QA session)