Protected by Supabase Auth and token-bucket rate limits.