fix: preserve route limits and harden restore marker

src/routes/api/sync/+server.ts

@@ -6,11 +6,11 @@ import { capabilityDisabledReason, capabilityEnabled } from '$lib/server/release
 import { configuration } from '$lib/server/config';
 export const POST: RequestHandler = async (event) => {
   const config = configuration();
-  protectMutation(event, `sync:${event.getClientAddress()}`, 6);
   if (!capabilityEnabled('asset_sync', config.capabilityAllowlist)) {
     return json({ error: capabilityDisabledReason('asset_sync') }, { status: 503 });
   }
   const current = await session(event);
+  protectMutation(event, `sync:${current?.userId ?? event.getClientAddress()}`, 6);
   if (!current) return json({ error: 'Connect an EVE character first.' }, { status: 401 });
   try {
     const result = await synchronize(current.userId);