Spam patterns and duplicate content are detected

Without spam detection, a single automated account can flood a community feed with duplicate or rapid-fire posts, drowning legitimate content and degrading the user experience to the point where real users leave. This is a CWE-770 (Allocation of Resources Without Limits) failure: uncapped post creation burns database storage and CDN bandwidth at attacker-controlled rates. Beyond quality, spam floods can mask coordinated manipulation campaigns — link farms, referral abuse, or coordinated inauthentic behavior — that are invisible without rate tracking.

Implement per-user rate limiting and content-hash deduplication on all post/comment submission handlers. In src/middleware/rateLimiter.ts:

import rateLimit from 'express-rate-limit';

export const postLimiter = rateLimit({
  windowMs: 5 * 60 * 1000, // 5 minutes
  max: 5,
  keyGenerator: (req) => req.user.id,
  message: 'Too many posts. Please wait before posting again.'
});

Pair rate limiting with a content-hash check: compute sha256(content) per user and reject exact duplicates submitted within the last hour. Reject at the API level before writing to the database.