refactor: purge Node.js, Rust is the one true backend

- Moved boosapi-rs/* to repo root
- Deleted all Node.js source (src/server/, src/web/, scripts/)
- Deleted node_modules, package.json, tsconfig, vite.config
- Updated .gitignore and AGENTS.md for Rust-only stack
- Fixed static file path for frontend dist/web/
- Dockerfile stays the same (already Rust-only)
- Kept dist/web/ for Rust static serving

src/services/shared/mod.rs

@@ -0,0 +1,45 @@
+use crate::{error::AppError, error::AppResult};
+use sqlx::SqlitePool;
+
+pub async fn enforce_key_request_limit(
+    db: &SqlitePool,
+    key_id: i64,
+    increment: i64,
+) -> AppResult<()> {
+    let row: Option<(Option<i64>, Option<i64>, Option<bool>)> = sqlx::query_as(
+        "SELECT max_requests, used_requests, enabled
+         FROM downstream_api_keys
+         WHERE id = ?",
+    )
+    .bind(key_id)
+    .fetch_optional(db)
+    .await?;
+
+    let (max_requests, used_requests, enabled) =
+        row.ok_or_else(|| AppError::Unauthorized("API key not found".into()))?;
+    if !enabled.unwrap_or(true) {
+        return Err(AppError::Forbidden("API key is disabled".into()));
+    }
+    if let Some(max_requests) = max_requests {
+        if used_requests.unwrap_or(0) + increment > max_requests {
+            return Err(AppError::RateLimited);
+        }
+    }
+    Ok(())
+}
+
+pub async fn increment_key_usage(db: &SqlitePool, key_id: i64, cost: f64) -> AppResult<()> {
+    sqlx::query(
+        "UPDATE downstream_api_keys
+         SET used_requests = COALESCE(used_requests, 0) + 1,
+             used_cost = COALESCE(used_cost, 0) + ?,
+             last_used_at = datetime('now'),
+             updated_at = datetime('now')
+         WHERE id = ?",
+    )
+    .bind(cost)
+    .bind(key_id)
+    .execute(db)
+    .await?;
+    Ok(())
+}