fix: P0 correctness/security fixes and P1 lint error resolution

P0: add missing 'developer' case to check_custom_feed_limit trigger,
scope user_entry_states join to authenticated user in API v1 entries,
replace in-memory rate limiting with Supabase-backed check_rate_limit RPC.

P1: fix all 9 ESLint errors — useSyncExternalStore for useIsMobile,
restructure WebhookSection to avoid set-state-in-effect, move ref
mutations into useEffect, replace <a> with <Link> on shared page,
ignore generated public/sw.js in eslint config.

1 files changed, 27 insertions, 17 deletions

diff --git a/apps/web/app/reader/settings/_components/api-settings.tsx b/apps/web/app/reader/settings/_components/api-settings.tsx
index cca673f..102e3fe 100644
--- a/apps/web/app/reader/settings/_components/api-settings.tsx
+++ b/apps/web/app/reader/settings/_components/api-settings.tsx
@@ -1,9 +1,8 @@
 "use client"
 
-import { useState, useEffect } from "react"
+import { useState } from "react"
 import { useMutation, useQuery, useQueryClient } from "@tanstack/react-query"
 import { useUserProfile } from "@/lib/queries/use-user-profile"
-import { queryKeys } from "@/lib/queries/query-keys"
 import { notify } from "@/lib/notify"
 
 interface ApiKey {
@@ -293,21 +292,36 @@ function ApiKeysSection() {
   )
 }
 
-function WebhookSection() {
+function WebhookSectionLoading() {
   const { data: webhookConfig, isLoading } = useWebhookConfig()
+
+  if (isLoading) {
+    return <p className="text-text-dim">loading webhook configuration ...</p>
+  }
+
+  if (!webhookConfig) {
+    return <p className="text-text-dim">failed to load webhook configuration</p>
+  }
+
+  return <WebhookSection initialConfiguration={webhookConfig} />
+}
+
+function WebhookSection({
+  initialConfiguration,
+}: {
+  initialConfiguration: WebhookConfiguration
+}) {
+  const { data: webhookConfig } = useWebhookConfig()
   const updateWebhookConfig = useUpdateWebhookConfig()
   const testWebhook = useTestWebhook()
-  const [webhookUrl, setWebhookUrl] = useState("")
-  const [webhookSecret, setWebhookSecret] = useState("")
+  const [webhookUrl, setWebhookUrl] = useState(
+    initialConfiguration.webhookUrl ?? ""
+  )
+  const [webhookSecret, setWebhookSecret] = useState(
+    initialConfiguration.webhookSecret ?? ""
+  )
   const [hasUnsavedChanges, setHasUnsavedChanges] = useState(false)
 
-  useEffect(() => {
-    if (webhookConfig) {
-      setWebhookUrl(webhookConfig.webhookUrl ?? "")
-      setWebhookSecret(webhookConfig.webhookSecret ?? "")
-    }
-  }, [webhookConfig])
-
   function handleSaveWebhookConfig() {
     updateWebhookConfig.mutate(
       {
@@ -371,10 +385,6 @@ function WebhookSection() {
     setHasUnsavedChanges(true)
   }
 
-  if (isLoading) {
-    return <p className="text-text-dim">loading webhook configuration ...</p>
-  }
-
   return (
     <div className="mb-6">
       <h3 className="mb-2 text-text-primary">webhooks</h3>
@@ -503,7 +513,7 @@ export function ApiSettings() {
   return (
     <div className="px-4 py-3">
       <ApiKeysSection />
-      <WebhookSection />
+      <WebhookSectionLoading />
 
       <div>
         <h3 className="mb-2 text-text-primary">api documentation</h3>