fix: isolate anonymous rollout rate limits

src/routes/api/chat/+server.ts

@@ -17,7 +17,7 @@ export const POST: RequestHandler = async (event) => {
     return json({ error: capabilityDisabledReason('assistant_dispatch') }, { status: 503 });
   }
   const current = await session(event);
-  protectMutation(event, `chat:${current?.userId ?? event.getClientAddress()}`);
+  if (current) protectMutation(event, `chat:${current.userId}`);
   const parsed = schema.safeParse(await boundedJson(event));
   if (!parsed.success) return json({ error: 'Provide a message (1–2000 characters) and a UUID requestId.' }, { status: 400 });
   const { message, requestId } = parsed.data;

src/routes/api/sync/+server.ts

@@ -13,7 +13,7 @@ export const POST: RequestHandler = async (event) => {
     return json({ error: capabilityDisabledReason('asset_sync') }, { status: 503 });
   }
   const current = await session(event);
-  protectMutation(event, `sync:${current?.userId ?? event.getClientAddress()}`, 6);
+  if (current) protectMutation(event, `sync:${current.userId}`, 6);
   if (!current) return json({ error: 'Connect an EVE character first.' }, { status: 401 });
   try {
     const result = await synchronize(current.userId);