Fix migration workflow: upload as artifact instead of scp to practice EC2

apps/web/middleware.ts

@@ -53,6 +53,25 @@ const RULES: Array<{ prefix: string; rules: Rule[] }> = [
     prefix: "/api/suggest",
     rules: [{ windowMs: 60_000, max: 120 }],
   },
+  // `/api/pdf` streams the whole 37MB source PDF from disk on every request,
+  // with no range support and no caching headers. It is unauthenticated, so
+  // repeated fetches are a bandwidth and memory cost on a single small EC2
+  // host. Sized against real UI behaviour rather than guessed: `tra-cuu`
+  // uses it as an iframe `src` whose `#page=` fragment changes per citation
+  // click, and `CitationCard` links to it, so a clinician working through a
+  // long evidence list can legitimately fetch it repeatedly. 30/min is far
+  // above that and still bounds an automated puller.
+  {
+    prefix: "/api/pdf",
+    rules: [{ windowMs: 60_000, max: 30 }],
+  },
+  // `/api/feedback` writes one row per answer (upsert keyed on trace_id), so
+  // the ceiling only needs to exceed how fast a human can rate answers. It
+  // reaches PostgreSQL on every call, which is why it is bounded at all.
+  {
+    prefix: "/api/feedback",
+    rules: [{ windowMs: 60_000, max: 60 }],
+  },
 ];
 
 const buckets = new Map<string, Bucket>();