Stop the test runner tripping the rate limiter, and level the rows

The end-to-end suite had never been run. Its first run failed six ways,
all of them the page sitting on the login screen: every browser page load
re-obtains an access token, the refresh endpoint allows thirty a minute
per address, and a twenty-test run makes about fifty of them from one
address. Half came back 429, and a failed refresh is indistinguishable
from being logged out. Raising the ceiling would only move it and make a
green suite depend on how fast the machine is, so the limiter is switched
off for the test backend alone — it measures a client, and the runner is
not one. It stays on everywhere else.

With that gone, one real failure was left, and it belonged to the commit
that claimed to have fixed it: cell widths were held, but a week whose
cell carries a holiday name still stood taller than its neighbours,
because each week is its own grid and none can see another's height. The
weeks now share one grid whose rows are all a single fraction, so the
tallest sets the rest and no cell can grow its own row.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Ei7gCZzdd751uZtPzb1Pep

backend/app/config.py

@@ -120,6 +120,18 @@ class Settings(BaseSettings):
 
     log_level: str = "INFO"
 
+    # Per-IP request rate limiting (slowapi). ON by default; the limits
+    # themselves are declared per-endpoint in the routers.
+    #
+    # Turn it OFF only where the "one IP == one client" assumption that
+    # `get_remote_address` relies on is false. The E2E suite is exactly that
+    # case: every browser page load in the whole run comes from 127.0.0.1,
+    # so the limiter ends up measuring the test runner rather than a user —
+    # a 20-test run makes ~50 `POST /api/auth/refresh` calls (one per page
+    # load) against a 30/minute budget and starts handing out 429s
+    # mid-suite. See the matching comment in `frontend/playwright.config.ts`.
+    rate_limit_enabled: bool = True
+
     # FK scraper — legal/ToS review completed (2026-06); cleared for use.
     # Default is True. Set APP_SCRAPER_ENABLED=false to disable (e.g. an
     # environment without Playwright chromium installed).

backend/app/rate_limit.py

@@ -2,9 +2,16 @@
 
 Lives in its own module so routers can import it without triggering the
 circular import that would occur if they imported from app.main.
+
+The limiter keys on the remote address, so it is only meaningful where one
+IP really is one client. `settings.rate_limit_enabled` exists to switch it
+off where that is not true (the E2E suite drives every page load from
+127.0.0.1) — see the comment on that setting in `app/config.py`.
 """
 
 from slowapi import Limiter
 from slowapi.util import get_remote_address
 
-limiter = Limiter(key_func=get_remote_address)
+from app.config import settings
+
+limiter = Limiter(key_func=get_remote_address, enabled=settings.rate_limit_enabled)