fix(auth): quote reserved "window" column in rate-limit SQL for Postgres (emdash-cms#946)

* fix(auth): quote reserved "window" column in rate-limit SQL for Postgres

* add changeset

Author: LeanderG

.changeset/sweet-toys-matter.md

@@ -0,0 +1,5 @@
+---
+"emdash": patch
+---
+
+Fixes Postgres rate-limit queries by quoting the reserved `window` column name.

packages/core/src/auth/rate-limit.ts

@@ -63,9 +63,9 @@ export async function checkRateLimit(
 
 	// Atomic upsert: insert or increment, return current count
 	const result = await sql<{ count: number }>`
-		INSERT INTO _emdash_rate_limits (key, window, count)
+		INSERT INTO _emdash_rate_limits (key, "window", count)
 		VALUES (${key}, ${windowStart}, 1)
-		ON CONFLICT (key, window)
+		ON CONFLICT (key, "window")
 		DO UPDATE SET count = _emdash_rate_limits.count + 1
 		RETURNING count
 	`.execute(db);
@@ -179,7 +179,7 @@ export async function cleanupExpiredRateLimits(
 	const cutoff = new Date(Date.now() - maxAgeSeconds * 1000).toISOString();
 
 	const result = await sql`
-		DELETE FROM _emdash_rate_limits WHERE window < ${cutoff}
+		DELETE FROM _emdash_rate_limits WHERE "window" < ${cutoff}
 	`.execute(db);
 
 	return Number(result.numAffectedRows ?? 0);