Logs in and calls a protected API endpoint to verify that authenticated requests now carry rate-limit controls.
Production limit: 120 authenticated API requests per user/IP per 60-second window. A blocked request returns HTTP 429 with Retry-After.
Do not import SQL.