fix(api): harden swipe access and quotas

[GSTJ]

Summary

We now gate protected API routes on active accounts and serialize concurrent swipe writes to enforce the free-plan rolling quota and prevent duplicate interest or match state.

Details

• Require an active account for protected routes while keeping account deletion available.
• Reject self, banned, deleted, and hidden profiles from the swipe deck and direct swipes.
• Use PostgreSQL transaction locks for free-plan quota and dog-pair writes, and preserve the last positive swipe timestamp through dislikes and dog replacement.
• Deduplicate old requester/responder pairs before adding a unique database constraint, while preserving their latest positive swipe time.
• Create and close matches inside the same transaction, then send notifications after it commits.

Testing steps

• Use a blocked account and confirm protected actions fail while account deletion still succeeds.
• Try to swipe your own profile and banned, deleted, or hidden profiles; each should be unavailable.
• Send more concurrent free-plan likes than the 24-hour limit allows; only the allowed likes should succeed.
• Like profiles, dislike some of them, replace the current dog profile, and confirm earlier positive likes still count toward the 24-hour free-plan limit.
• Have two profiles like each other at the same time and confirm there is one active match.
• pnpm test
• pnpm typecheck
• pnpm lint
• pnpm format
• pnpm exec dotenv -e .env.test -- pnpm -F @pegada/nextjs build

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[GSTJ]

Local proof for 8f7caa9: targeted security tests, a fresh PostgreSQL migration, the full repository suite, typecheck, lint, formatting, and the production Next.js build.