feat(api): align waitlist signup endpoint

[lukevio]

What

Aligns the public POST /waitlist endpoint with #470.

Why

The landing page needs a durable, unauthenticated pre-launch signup endpoint with predictable validation, idempotent duplicates, and abuse protection.

How

• Validates email with trimming, RFC-style email validation, and a 254 character max.
• Returns 422 with validation details for invalid request bodies.
• Persists normalized lowercase emails into the existing waitlist table.
• Uses ON CONFLICT (email) DO NOTHING RETURNING id so new signups return 201 and duplicate signups return 200 without inserting again.
• Returns { "message": "You're on the list!" } for both successful and duplicate submissions.
• Updates the waitlist limiter to 5 requests per IP per hour.
• Strengthens tests for happy path, duplicate email, invalid email, max length, limiter application, and limiter blocking.

Test plan

• ./node_modules/.bin/vitest run apps/api/src/routes/waitlist.test.ts
• ./node_modules/.bin/prettier --check apps/api/src/routes/waitlist.ts apps/api/src/routes/waitlist.test.ts
• git diff --cached --no-color | node scripts/gitleaks.mjs detect --pipe --redact --config .gitleaks.toml --verbose
• ./node_modules/.bin/tsc -p apps/api/tsconfig.json --noEmit currently blocked by existing unrelated apps/api/src/routes/leaderboard.ts(196,1): error TS1128

Notes:

• apps/api/src/middleware/rate-limit.ts has pre-existing Prettier differences outside the waitlist limiter block, so I avoided formatting the whole file to keep this PR focused.
• The local Husky hook invokes pnpm gitleaks:pre-commit, but pnpm exits first due ignored build-script approvals for @fingerprintjs/fingerprintjs-pro-react and @sentry/cli. I ran the underlying staged-diff gitleaks command directly and it passed.

Closes #470