Fix: harden billing engine, auth middleware, and request throttling

.gitignore

@@ -92,5 +92,4 @@ fallow_review.txt
 otel-collector-config-local.yaml
 
 # Personal deployment guide
-DEPLOY.md
 Plan.md

AGENTS.md

@@ -118,7 +118,7 @@ When the user requests a durable behavior change, record it here or in the relev
 - **Migration baseline:** All migrations were squashed into `src/db/migrations/0000_init.sql` (July 2026). This includes `rate_override` on `billing_periods` and all schema up to that date. Future migrations start from `0001`. The `meta/` folder contains only `0000_snapshot.json` and `_journal.json`. Stale snapshots and the two `0001_*` migration files were removed during the July 2026 squash.
 
 - **Local dev seed:** Run `pnpm seed:fresh` to reset the local D1 database and insert demo fixtures. Credentials: owner@demo.meterly.app / DemoOwner123, tenant@demo.meterly.app / DemoTenant123. Script is at `scripts/seed.ts`. Never commit real data to this script. **Password hashing in seed.ts must use `hashPassword` from `better-auth/crypto`** — not bcryptjs or any other library. Better Auth's verifier expects a `salt:hash` hex format (scrypt); bcrypt hashes (`$2b$...`) will throw `"Invalid password hash"` at login.
-- **Edit request throttle after overwrite:** Edit request rate limits are applied per-tenant across all periods. However, when a tenant submits a new request for a period that _already_ has a pending request, the old request is cancelled _before_ the rate limit check. This intentional cancel-then-throttle logic allows same-period overwrites to succeed while still preventing cross-period spam.
+- **Edit request throttle after overwrite:** Edit request rate limits are applied per-tenant per-property. The throttle check runs _first_ but subtracts any existing same-period pending request from the total count. Only after passing the throttle is the existing request cancelled and overwritten. This ensures strict upper bounds without penalizing same-period correction updates.
 
 ### CI / Developer Tooling