> auth need more attention, but structure is the first focus.
- Extracted rateLimit/requireToken into src/middleware.js so the new /api/user routes reuse the exact same guards as /api/argument, not a second copy.
- All 10 tests pass (4 new ones covering the fallback label, registration, validation, and the non-retroactive behavior specifically).
- Caddy updated with /user routing, cherry-picked onto deploy-production the same way as last time (map-exclusion commit still untouched).