fix: add rate limiting to /poll endpoint + fix test type errors (BUG-S3)

- Add rateLimit(1_000, 30) middleware to GET /poll endpoint
- Fix Challenge type errors in human-responses test files (missing baseDamage)
- Add rate-limit unit test verifying 429 after exceeding limit

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/fights.ts

@@ -9,7 +9,7 @@ import { runMockFight, isClassicBot } from '../engine/mock.js'
 import { startFightLoop } from '../engine/fight-loop.js'
 import { runFight, runFightAsync, isInFight, getActiveFightId } from '../engine/orchestrator.js'
 import { fightEvents } from '../engine/events.js'
-import { botRateLimit } from '../middleware/rate-limit.js'
+import { botRateLimit, rateLimit } from '../middleware/rate-limit.js'
 import { getPendingChallenge, getPendingAnswers, submitHumanResponse } from '../engine/human-responses.js'
 import { getPendingPollChallenge, submitPollResponse, isPollingBot } from '../engine/poll-responses.js'
 import { authenticateBot } from '../middleware/bot-auth.js'
@@ -372,7 +372,7 @@ fightsRouter.post('/:fightId/respond/:botId', async (c) => {
 // --- Polling API (for bots that don't expose a public URL) ---
 
 // Poll for a pending challenge (bot authenticates with id+secret)
-fightsRouter.get('/poll', async (c) => {
+fightsRouter.get('/poll', rateLimit(1_000, 30), async (c) => {
   const botOrRes = await authenticateBot(c)
   if (botOrRes instanceof Response) return botOrRes
   const bot = botOrRes