Adds an in-memory, IP-based fixed-window rate limit (max 3 req/hour)
to app/api/familyguard-flyer/route.ts to mitigate an email-spam/abuse
vector where any client could trigger outbound emails and DB inserts
with no limit. Also guards against a non-string `email` field in the
request body, which previously threw an uncaught TypeError (HTTP 500)
instead of the intended 400 validation response.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhY1QhDXGWfyhrxaJvfpNt
Creates POST /api/familyguard-flyer endpoint that validates email format
and DSGVO consent, records download intent in Supabase flyer_downloads table,
and sends notification and download link emails (fire-and-forget) before
returning the flyer download URL.
Implements Task 4 of 7-task email-gated flyer download feature.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LhY1QhDXGWfyhrxaJvfpNt
MBO-Tech-IT