security: implement HASH-001 and ENUM-001 remediations

HASH-001: Add threading lock to content hash deduplication
- Prevents race condition between SELECT and UPDATE
- Ensures accurate dedup counting under concurrent load

ENUM-001: Add rate limiting to paste lookups
- Separate rate limiter for GET/HEAD on paste endpoints
- Default 60 requests/minute per IP (configurable)
- Prevents brute-force paste ID enumeration attacks

tests/conftest.py

@@ -4,7 +4,7 @@ import pytest
 
 import app.database as db_module
 from app import create_app
-from app.api.routes import reset_rate_limits
+from app.api.routes import reset_lookup_rate_limits, reset_rate_limits
 
 
 def _clear_database():
@@ -22,6 +22,7 @@ def app():
     """Create application for testing."""
     # Reset global state for test isolation
     reset_rate_limits()
+    reset_lookup_rate_limits()
     _clear_database()
 
     test_app = create_app("testing")
@@ -33,6 +34,7 @@ def app():
 
     # Cleanup after test
     reset_rate_limits()
+    reset_lookup_rate_limits()
 
 
 @pytest.fixture