fix: harden residual route and restore checks

src/routes/api/sync/+server.ts

@@ -6,6 +6,9 @@ import { capabilityDisabledReason, capabilityEnabled } from '$lib/server/release
 import { configuration } from '$lib/server/config';
 export const POST: RequestHandler = async (event) => {
   const config = configuration();
+  // Bound origin/session work by the existing anonymous IP bucket first. The
+  // normal authenticated user-keyed limiter is restored after resolution.
+  protectMutation(event, `sync:${event.getClientAddress()}`, 6);
   if (!capabilityEnabled('asset_sync', config.capabilityAllowlist)) {
     return json({ error: capabilityDisabledReason('asset_sync') }, { status: 503 });
   }