Add per-user rate limiting

[freesoft]

Phase 3: LLM Cost Management

No rate limiting — one user can exhaust the shared API quota.

Tasks

• Implement per-user request limits (per minute / per day)
• Return clear error message when limit is hit
• Consider using Redis or in-memory sliding window

Files

• web_tutor.py