fix: resolve 6 pre-ship audit bugs

- Webhook entry identifier: use entry GUID instead of feed identifier
- Optimistic rollback: add previousTimeline snapshot and onError handler
  to both useToggleEntryReadState and useToggleEntrySavedState
- Rate limiter memory leak: delete Map entries when window expires,
  use else-if to avoid re-setting after delete
- Entries API limit param: use Number.isFinite guard instead of falsy
  coercion that treats 0 as default
- PWA manifest: add PNG raster icon routes (192x192, 512x512) for
  devices that don't support SVG icons
- Billing webhook: throw on DB errors and return 500 so Stripe retries
  failed events instead of silently losing them

1 files changed, 3 insertions, 1 deletions

diff --git a/apps/web/lib/rate-limit.ts b/apps/web/lib/rate-limit.ts
index 4016781..506511d 100644
--- a/apps/web/lib/rate-limit.ts
+++ b/apps/web/lib/rate-limit.ts
@@ -12,7 +12,9 @@ export function rateLimit(
     (timestamp) => timestamp > windowStart
   )
 
-  if (recentTimestamps.length >= limit) {
+  if (recentTimestamps.length === 0) {
+    requestTimestamps.delete(identifier)
+  } else if (recentTimestamps.length >= limit) {
     requestTimestamps.set(identifier, recentTimestamps)
     return { success: false, remaining: 0 }
   }