fix: harden CI and close remaining test/security gaps

- Make webhook URL tests deterministic with injectable DNS resolver
- Wire tier parity checker into CI and root scripts
- Add rate_limits cleanup cron job (hourly, >1hr retention)
- Change rate limiter to fail closed on RPC error
- Add Go worker tests: parser, SSRF protection, error classification,
  authentication, and worker pool (48 test functions)

1 files changed, 4 insertions, 25 deletions

diff --git a/scripts/check-tier-parity.ts b/scripts/check-tier-parity.ts
index 0681af0..d7ee8a4 100644
--- a/scripts/check-tier-parity.ts
+++ b/scripts/check-tier-parity.ts
@@ -1,26 +1,6 @@
 import { readFileSync } from "fs"
 import { resolve } from "path"
-
-const TIER_LIMITS = {
-  free: {
-    maximumFeeds: 10,
-    maximumFolders: 3,
-    maximumMutedKeywords: 5,
-    maximumCustomFeeds: 1,
-  },
-  pro: {
-    maximumFeeds: 200,
-    maximumFolders: 10000,
-    maximumMutedKeywords: 10000,
-    maximumCustomFeeds: 1000,
-  },
-  developer: {
-    maximumFeeds: 500,
-    maximumFolders: 10000,
-    maximumMutedKeywords: 10000,
-    maximumCustomFeeds: 1000,
-  },
-} as const
+import { TIER_LIMITS } from "../packages/shared/source/index.ts"
 
 const TRIGGER_MAP: Record<string, keyof (typeof TIER_LIMITS)["free"]> = {
   check_subscription_limit: "maximumFeeds",
@@ -29,8 +9,7 @@ const TRIGGER_MAP: Record<string, keyof (typeof TIER_LIMITS)["free"]> = {
   check_custom_feed_limit: "maximumCustomFeeds",
 }
 
-const CASE_PATTERN =
-  /when\s+'(\w+)'\s+then\s+(\d+)/g
+const CASE_PATTERN = /when\s+'(\w+)'\s+then\s+(\d+)/g
 
 function extractSqlLimits(
   schemaContent: string,
@@ -45,7 +24,8 @@ function extractSqlLimits(
     throw new Error(`function ${functionName} not found in schema`)
   }
 
-  const caseLinePattern = /maximum_allowed\s*:=\s*case\s+current_tier\s+(.*?)\s+end/is
+  const caseLinePattern =
+    /maximum_allowed\s*:=\s*case\s+current_tier\s+(.*?)\s+end/is
   const caseMatch = functionMatch[0].match(caseLinePattern)
   if (!caseMatch) {
     throw new Error(`case expression not found in ${functionName}`)
@@ -87,7 +67,6 @@ for (const [functionName, tsKey] of Object.entries(TRIGGER_MAP)) {
 
 if (hasErrors) {
   console.error("\nTier limit parity check FAILED")
-  // eslint-disable-next-line no-process-exit
   process.exit(1)
 } else {
   console.log("Tier limit parity check PASSED — all limits match")