fix(security): close the case-sensitivity bypass in the API rate limiter

Express's `case sensitive routing` is off by default, so /API/admin/events
reaches the same handler as /api/admin/events. Both the gate's `/api/` prefix
test and rateLimitService's public-endpoint classification compared the raw
path, so simply upper-casing a letter skipped the limiter entirely.

Verified against a real Express app before fixing: /api/admin/events routes
and hits the gate; /API/admin/events and /Api/Admin/Events route and miss it.

Both now match on a lower-cased path. The auth gate added alongside was
already immune -- its patterns carry the `i` flag for exactly this reason.

Not changed: rateLimitSecurity.hasValidAdminToken's /api/admin/ test has the
same shape, but there the case-sensitive comparison fails safe -- an
upper-cased path simply does not get the admin skip, so it is rate limited
rather than exempted. Making it case-insensitive would widen a skip, so it is
left alone. maintenance.js's isAdminRoute is fail-safe for the same reason.

backend/__tests__/middleware/apiRateLimitGate.test.js

@@ -54,6 +54,15 @@ describe('apiRateLimitGate — delegation', () => {
     expect(limiterCalls).toEqual(['/api/admin/events']);
   });
 
+  it('still limits an upper-cased /api path, which Express routes the same', async () => {
+    // Express's `case sensitive routing` is off by default, so /API/admin/events
+    // reaches the same handler. A case-sensitive prefix test in the gate was a
+    // free bypass of the limiter.
+    const res = await request(buildApp()).get('/API/admin/events');
+    expect(res.status).toBe(429);
+    expect(limiterCalls).toEqual(['/API/admin/events']);
+  });
+
   it('leaves non-/api requests alone', async () => {
     const res = await request(buildApp()).get('/photos/x.jpg');
     expect(res.status).toBe(200);