fix: rate limiter was blocking all /api/cats reads after 10 requests

uploadLimiter now only applies to POST /api/cats (uploads), not GET
reads — previously users were getting 429 after ~10 page navigations.
Also remove duplicate file input in ProfilePage and cancel stale rAF
on route transition cleanup.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

client/src/pages/ProfilePage.tsx

@@ -268,7 +268,6 @@ export default function ProfilePage() {
             <div className="divider mb-4" />
 
             <div>
-              <input type="file" ref={fileInputRef} onChange={onFileChange} accept="image/*" className="hidden" />
               <Button
                 variant="outline"
                 onClick={() => fileInputRef.current?.click()}