fix: rate limiter was blocking all /api/cats reads after 10 requests

uploadLimiter now only applies to POST /api/cats (uploads), not GET
reads — previously users were getting 429 after ~10 page navigations.
Also remove duplicate file input in ProfilePage and cancel stale rAF
on route transition cleanup.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

client/src/App.tsx

@@ -33,10 +33,11 @@ function AnimatedRoutes() {
     if (el) {
       el.classList.remove('page-enter-active');
       el.classList.add('page-enter');
-      requestAnimationFrame(() => {
+      const rafId = requestAnimationFrame(() => {
         el.classList.remove('page-enter');
         el.classList.add('page-enter-active');
       });
+      return () => cancelAnimationFrame(rafId);
     }
   }, [location.pathname]);
 

client/src/pages/ProfilePage.tsx

@@ -268,7 +268,6 @@ export default function ProfilePage() {
             <div className="divider mb-4" />
 
             <div>
-              <input type="file" ref={fileInputRef} onChange={onFileChange} accept="image/*" className="hidden" />
               <Button
                 variant="outline"
                 onClick={() => fileInputRef.current?.click()}

server/src/index.ts

@@ -54,7 +54,11 @@ async function main() {
     standardHeaders: true,
     legacyHeaders: false,
   });
-  app.use('/api/cats', uploadLimiter);
+  // Rate-limit only cat uploads (POST), not reads
+  app.use('/api/cats', (req, _res, next) => {
+    if (req.method !== 'POST') return next();
+    return uploadLimiter(req, _res, next);
+  });
 
   app.use('/uploads', express.static(path.join(__dirname, '..', 'uploads')));