feat: rate limit public routes; backfill v0.9.5 changelog for mobile audit

Sign-in/sign-up now throttle at 3 req/10s/IP via better-auth's built-in
rate limiter; /r/ and /s/ share links throttle at 60 req/min/IP via
proxy.ts using the existing Redis-backed limiter (Next 16's Proxy always
runs Node.js, no Edge-runtime blocker after all).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/changelog.ts

@@ -1,5 +1,5 @@
 // Mirrors CHANGELOG.md at the repo root — update both together.
-export const APP_VERSION = "0.9.4";
+export const APP_VERSION = "0.9.6";
 
 export type ChangelogEntry = {
   version: string;
@@ -11,6 +11,21 @@ export type ChangelogEntry = {
 };
 
 export const CHANGELOG: ChangelogEntry[] = [
+  {
+    version: "0.9.6",
+    date: "2026-07-13 09:31",
+    added: [
+      "**Rate limiting on public routes**: sign-in/sign-up now throttle after 3 attempts per 10s per IP; public recipe/shopping-list share links (`/r/`, `/s/`) throttle after 60 requests/min per IP.",
+    ],
+  },
+  {
+    version: "0.9.5",
+    date: "2026-07-13 09:20",
+    fixed: [
+      "Explore page's \"Recipe ideas\" input got squeezed to a couple of visible characters on mobile — buttons now stay icon-only below `sm:`.",
+      "The per-recipe chat button could overlap the private-notes save button on short recipe pages.",
+    ],
+  },
   {
     version: "0.9.4",
     date: "2026-07-13 09:03",