refactor(rate-limit): 1 req/sec cooldown, batch up to 2048 (#3)

* refactor(rate-limit): switch to 1 req/sec cooldown, batch size up to 2048

Replace per-pixel credit/token-bucket model with a simple per-user cooldown
(SET NX EX 1). Batch size is now independent of the rate limit and capped
at MAX_BATCH_SIZE = 2048.

- rate-limiter: SET NX EX replaces Lua credit script
- worker: response shape { ok: true } (no credits field)
- client: drop credit state/timer/UserInfo; uploader paces by cooldown
- tests: mock checkRateLimit; integration test exercises SET NX EX
- docs: README, system-architecture, code-standards, deployment-guide

* chore(plans): remove implemented plan directories

rplace-implementation (base build), review-fixes, and
image-importer-enhancements are all shipped. Keep plans/reports/ as
historical code-review and research references.

src/worker.js

@@ -1,7 +1,7 @@
 import { Hono } from 'hono';
 import { getFullCanvas, setPixels } from './lib/canvas-storage.js';
 import { getUserId } from './lib/get-user-id.js';
-import { checkAndDeductCredits } from './lib/rate-limiter.js';
+import { checkRateLimit } from './lib/rate-limiter.js';
 import { CANVAS_WIDTH, CANVAS_HEIGHT, MAX_COLORS, MAX_BATCH_SIZE } from './lib/constants.js';
 
 export { CanvasRoom } from './durable-objects/canvas-room.js';
@@ -67,13 +67,11 @@ app.post('/api/place', async (c) => {
     }
   }
 
-  // Rate limiting
+  // Rate limiting — 1 request per second per user, regardless of batch size.
   const userId = await getUserId(c.req.raw);
-  const { allowed, remaining, retryAfter } = await checkAndDeductCredits(
-    c.env, userId, pixels.length,
-  );
+  const { allowed, retryAfter } = await checkRateLimit(c.env, userId);
   if (!allowed) {
-    return c.json({ error: 'rate_limited', remaining, retryAfter }, 429);
+    return c.json({ error: 'rate_limited', retryAfter }, 429);
   }
 
   // Persist pixels (must succeed before broadcast)
@@ -95,7 +93,7 @@ app.post('/api/place', async (c) => {
     broadcastTask.catch((err) => console.error('Broadcast:', err));
   }
 
-  return c.json({ ok: true, credits: remaining });
+  return c.json({ ok: true });
 });
 
 async function broadcastPixels(env, pixels) {