security: rate-limit POST /api/report-question to 30 requests/hour per IP

[xpoes123]

POST /api/report-question had no rate limiting, making it trivial to flood the database with spurious reports.

Problem

routes/api/report-question.js accepted an unlimited number of POST requests per IP. An automated client could generate thousands of bogus reports at no cost, polluting the moderation queue and adding unbounded write load to the database.

Changes

• Adds express-rate-limit (already a project dependency) to routes/api/report-question.js.
• Limits each IP to 30 requests per hour; uses standardHeaders: true and legacyHeaders: false, matching the pattern already used in routes/auth/index.js.

Risk & testing

Rate limiting is applied at the router level before the handler, so legitimate users are unaffected at normal usage volumes. No new dependencies introduced. semistandard and node --check pass.