fix limiter

backend/telemetry.py

@@ -24,6 +24,7 @@ while making reversal impractical even if the hash list is leaked.
 from fastapi import APIRouter, Request
 from pydantic import BaseModel
 import os, sqlite3, json, hmac, hashlib
+from limiter import limiter
 from datetime import datetime
 from typing import Any, Dict, Optional
 

public/generate_planning_report.php

@@ -1,9 +1,4 @@
-<?php declare(strict_types=1);
-require_once __DIR__ . '/_bootstrap.php';
-
-ini_set('display_errors', '0');
-ini_set('log_errors', '1');
-error_reporting(E_ALL);
+<?php
 /**
  * Planning Report Generator (MVP)
  * Input:  JSON payload (see schema below)
@@ -13,6 +8,14 @@ error_reporting(E_ALL);
  * Test:     curl -s -X POST -H "Content-Type: application/json" \
  *           --data @sample.json http://localhost/internal/classes/generate_planning_report.php | jq
  */
+
+declare(strict_types=1);
+require_once __DIR__ . '/_bootstrap.php';
+
+ini_set('display_errors', '0');
+ini_set('log_errors', '1');
+error_reporting(E_ALL);
+
 $corsEnv = getenv('CORS_ORIGINS') ?: 'https://tasplanning.report';
 $allowedOrigins = array_filter(array_map('trim', explode(',', $corsEnv)));
 $origin = $_SERVER['HTTP_ORIGIN'] ?? '';
@@ -32,9 +35,6 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') {
     exit; // stop here, no body required
 }
 
-
-
-
 header('Content-Type: application/json; charset=UTF-8');
 
 try {