fix: PSR-4 compliance — rename core/middleware/services to PascalCase for Linux server compatibility

app/Middleware/RateLimitMiddleware.php

@@ -0,0 +1,71 @@
+<?php
+/**
+ * Rate Limiting Middleware (File-based, Race-Condition Safe)
+ */
+
+declare(strict_types=1);
+
+namespace App\Middleware;
+
+final class RateLimitMiddleware
+{
+    /**
+     * File-based rate limiter with file-lock to prevent race conditions.
+     * For multi-server deployments, replace with Redis.
+     */
+    public static function check(int $maxRequests = 60, int $timeWindow = 60): void
+    {
+        $ip        = $_SERVER['REMOTE_ADDR'] ?? 'unknown';
+        $cacheDir  = STORAGE_PATH . '/cache';
+        $cacheFile = $cacheDir . '/rl_' . md5($ip) . '.json';
+
+        if (!is_dir($cacheDir)) {
+            mkdir($cacheDir, 0755, true);
+        }
+
+        // M2 Fix: Use exclusive file lock to prevent race condition
+        $fp = fopen($cacheFile, 'c+');
+        if ($fp === false) {
+            // If we can't open the file, fail open (don't block all users)
+            return;
+        }
+
+        try {
+            flock($fp, LOCK_EX); // Exclusive lock — blocks until acquired
+
+            $now      = time();
+            $content  = stream_get_contents($fp);
+            $requests = [];
+
+            if (!empty($content)) {
+                $decoded = json_decode($content, true);
+                if (is_array($decoded)) {
+                    // Keep only requests within the time window
+                    $requests = array_values(
+                        array_filter($decoded, fn($ts) => $ts > ($now - $timeWindow))
+                    );
+                }
+            }
+
+            if (count($requests) >= $maxRequests) {
+                flock($fp, LOCK_UN);
+                fclose($fp);
+                
+                header('Retry-After: ' . $timeWindow);
+                json_error('Too Many Requests. Please slow down.', 429);
+            }
+
+            // Record this request
+            $requests[] = $now;
+
+            // Write updated data back
+            ftruncate($fp, 0);
+            rewind($fp);
+            fwrite($fp, json_encode($requests));
+
+        } finally {
+            flock($fp, LOCK_UN);
+            fclose($fp);
+        }
+    }
+}