Fix rate limits, concurrency control, copy button

- DATA-BACKED RATE LIMITS:
  * Reduce global rate limit from 10,000/min to 100/min
  * Add PDF conversion rate limits: 10/min free, 30/min pro
  * Set recovery rate limit to 3/hour (was 5/hour)
  * Add concurrency limiter: max 3 simultaneous PDFs, queue rest
  * Return 429 if queue > 10

- BUG-025: Fix copy button functionality
  * Improve fallback handling for execCommand
  * Add better error handling and user feedback
  * Fix secure context detection

- Add concurrency monitoring endpoint /v1/concurrency

decisions.md

@@ -0,0 +1,21 @@
+# DocFast Decisions Log
+
+## 2026-02-14: Mandatory QA After Every Deployment
+
+**Rule:** Every deployment MUST be followed by a full QA session. No exceptions.
+
+**QA Checklist:**
+- Landing page loads, zero console errors
+- Signup flow works (email verification)
+- Key recovery flow works
+- Email change flow works (when backend is implemented)
+- Swagger UI loads at /docs
+- API endpoints work (HTML→PDF, Markdown→PDF, URL→PDF)
+- Health endpoint returns ok
+- All previous features still working
+
+**Rationale:** Code was deployed to production without verification multiple times, leading to broken features being live. QA catches regressions before users do.
+
+## 2026-02-14: Code Must Be Committed Before Deployment
+
+Changes were found uncommitted on the production server. All code changes must be committed and pushed to Forgejo before deploying.