scan-limits-gating: paid-order gating + per-tag daily cap + per-IP hourly rate (6/6 scenarios) — no gateway

db/schema.sql

@@ -71,3 +71,6 @@ ALTER TABLE scans ADD COLUMN IF NOT EXISTS fingerprint TEXT;
 ALTER TABLE users ADD COLUMN IF NOT EXISTS is_admin BOOLEAN NOT NULL DEFAULT FALSE;
 -- Phase 4: Laravel session auth "remember me" token (idempotent).
 ALTER TABLE users ADD COLUMN IF NOT EXISTS remember_token TEXT;
+
+-- Phase 5-lite: client IP on scans for rate limiting (idempotent).
+ALTER TABLE scans ADD COLUMN IF NOT EXISTS ip TEXT;