Initial scaffold: tooling, plan, task briefs

- pnpm 10 workspace + TypeScript strict + ESLint flat + Prettier
- CLAUDE.md as canonical brief
- docs/tasks/ — 22 task briefs broken out by phase for sub-sessions
- docs/decisions/ — ADR scaffold

Implements task 01 (repo-init).

docs/tasks/61-rate-limit.md

@@ -0,0 +1,24 @@
+# 61 — Rate limiting on share links
+
+## Goal
+
+Prevent token brute-forcing on `/s/<token>`.
+
+## Depends on
+
+- 31
+
+## Scope
+
+- IP + token-prefix bucket. Reject after N failed lookups per minute per IP. In-memory LRU is fine for one Node process; document switch to Redis if multi-process arrives.
+- Failed `resolveShareToken` calls increment the bucket; successful resolves do not.
+- Generic `lib/rate-limit.ts` so other endpoints can use the same primitive.
+
+## Out of scope
+
+- Captcha.
+
+## Acceptance criteria
+
+- [ ] 50 bad tokens from one IP in a minute returns 429 thereafter.
+- [ ] Legitimate access from another IP unaffected.