v1.5.6: boneyard-js skeleton migration, TanStack Query refactor, rate-limit config

- Replace hand-coded skeleton CSS/JSX with boneyard-js auto-generated bones
- Remove skeleton.css and @keyframes shimmer from base.css
- Add <Skeleton> wrappers with fixtures to all 25+ page components
- Generate 20 bone captures via boneyard CLI (CDP auth-gated capture)
- Refactor data fetching from useEffect+useState to TanStack Query
- Extract query hooks into src/admin/lib/queries/ and apiAdapter
- Add usePaginatedQuery hook replacing useApiCall/useListData
- Fix parseFloat || 0 anti-pattern in OfferDetail and OffersTemplates inputs
- Fix customer_id mandatory validation on offer creation
- Fix leave-requests comma-separated status filter (Prisma enum in: [])
- Add cross-entity cache invalidation for orders/offers/invoices/projects
- Make rate limits configurable via env vars (RATE_LIMIT_MAX, RATE_LIMIT_REFRESH, etc.)
- Add boneyard.config.json with routes and breakpoints

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/config/env.ts

@@ -90,6 +90,23 @@ export const config = {
     origins: (process.env.CORS_ORIGINS || "").split(",").filter(Boolean),
   },
 
+  rateLimit: {
+    max: Math.max(1, parseInt(process.env.RATE_LIMIT_MAX || "300", 10) || 300),
+    timeWindow: process.env.RATE_LIMIT_WINDOW || "1 minute",
+    login: Math.max(
+      1,
+      parseInt(process.env.RATE_LIMIT_LOGIN || "20", 10) || 20,
+    ),
+    loginTotp: Math.max(
+      1,
+      parseInt(process.env.RATE_LIMIT_TOTP || "5", 10) || 5,
+    ),
+    refresh: Math.max(
+      1,
+      parseInt(process.env.RATE_LIMIT_REFRESH || "10", 10) || 10,
+    ),
+  },
+
   trustProxy: (process.env.TRUST_PROXY || "")
     .split(",")
     .map((s) => s.trim())