## Description The `publishBuild` GraphQL mutation is publicly accessible without authentication, rate limiting, or publishing quotas. This allows users to repeatedly publish builds, potentially flooding the database with spam. Implement server-side abuse protection while preserving anonymous publishing. GraphQL requests should also have reasonable limits to prevent excessively expensive operations. Relevant files: - `backend/server/src/index.ts` - `backend/server/src/schema.ts` - `backend/server/src/resolvers.ts` ## Acceptance criteria - [ ] Implement server-side rate limiting for build publishing (e.g., IP-based). - [ ] Add reasonable GraphQL request depth, complexity, and/or size limits. - [ ] Return appropriate errors when limits are exceeded without creating database entries. - [ ] Verify that excessive publishing requests are blocked while normal publishing and read operations continue to work. - [ ] Document the configured limits. ## Dependencies None.