[Bug] No comment length limit or rate limiting on ratings API

[realproject7]

Bug

src/app/api/ratings/route.ts has no input validation on comment length and no rate limiting.

Issues:

1. No comment length limit: Users can submit arbitrarily long comments stored in the DB. Neither the API nor the UI (RatingWidget.tsx textarea) enforces a max length.
2. No rate limiting: Each POST triggers signature recovery + DB read + RPC call + DB upsert. No throttling.
3. No pagination on GET: Returns all ratings for a storyline with no limit. Large response for popular storylines.

Fix:

• Add maxLength on the textarea in RatingWidget.tsx (e.g., 500 chars)
• Validate comment length server-side in the API route
• Add pagination params to GET (e.g., ?limit=20&offset=0)
• Consider rate limiting via middleware or simple IP-based throttle

Context: Introduced in PR #84 (API) and PR #85 (UI).

Checklist:

• Add comment length validation (API + UI)
• Add pagination to GET endpoint
• npm run lint and npm run typecheck pass

Labels: bug, agent/T3