Standalone Shonar Desktop: vendor portable sources + local engine; decouple from ~/Projects/Shonar

- shared/ = portable Android-origin sources vendored from deferred/desktop-server
  (app/build.gradle.kts srcDir repointed; PlaybackController.kt excluded as Android-only)
- backend/ = bundled-lite engine (SQLite + inline queue); .venv symlinked from the
  old checkout, PYTHONPATH pins THIS backend's code over any editable install
- repoRoot() resolves this project dir (env SHONAR_REPO still wins); desktop-dev.sh
  watches shared/ + backend/
- Verified: :app:compileKotlin + :app:test green (23 tests); engine boots on :8010,
  self-migrates, /healthz ok

backend/shonar/core/ratelimit.py

@@ -0,0 +1,19 @@
+"""Rate limiting (slowapi). A single shared limiter instance so counters are
+consistent across endpoints; limit strings come from settings/env."""
+
+from __future__ import annotations
+
+from slowapi import Limiter
+from slowapi.util import get_remote_address
+
+from shonar.core.config import get_settings
+
+_settings = get_settings()
+
+limiter = Limiter(
+    key_func=get_remote_address,
+    default_limits=[],
+    enabled=True,
+)
+
+auth_limit = limiter.limit(_settings.rate_limit_auth)