feat: Add comprehensive abuse detection and prevention system

migrations/20260407_add_semver_label_columns.sql

@@ -1,10 +1,5 @@
--- Add semver and label columns to benchmark_versions table
--- These may already exist if added manually via D1 Studio
-ALTER TABLE benchmark_versions ADD COLUMN semver TEXT;
-ALTER TABLE benchmark_versions ADD COLUMN label TEXT;
-
--- Backfill: If id looks like a semver (X.Y.Z), use it for both columns
--- Otherwise default to 0.0.1
+-- Backfill semver and label columns on benchmark_versions.
+-- Columns are added in the prior migration (20260406_add_semver_columns.sql).
 UPDATE benchmark_versions
 SET semver = CASE 
     WHEN id GLOB '[0-9]*.[0-9]*' OR id GLOB '[0-9]*.[0-9]*.[0-9]*' THEN id

migrations/20260408_add_submission_limits_and_flags.sql

@@ -0,0 +1,18 @@
+-- Rate limiting for benchmark submissions
+CREATE TABLE IF NOT EXISTS submission_rate_limits (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  token_id TEXT NOT NULL,
+  ip TEXT NOT NULL,
+  created_at TEXT NOT NULL DEFAULT (datetime('now')),
+  FOREIGN KEY (token_id) REFERENCES tokens(id)
+);
+
+CREATE INDEX IF NOT EXISTS idx_submission_rate_limits_token_id ON submission_rate_limits(token_id);
+CREATE INDEX IF NOT EXISTS idx_submission_rate_limits_ip ON submission_rate_limits(ip);
+CREATE INDEX IF NOT EXISTS idx_submission_rate_limits_created_at ON submission_rate_limits(created_at);
+
+-- Flagging suspicious submissions
+ALTER TABLE submissions ADD COLUMN is_flagged INTEGER NOT NULL DEFAULT 0;
+ALTER TABLE submissions ADD COLUMN flag_reason TEXT;
+
+CREATE INDEX IF NOT EXISTS idx_submissions_is_flagged ON submissions(is_flagged);