Session 32: Grades pipeline + NFL/NHL wiring + rate limiting + audit cleanup (1718 tests)

- gradeSlateService writes grades:{sport} cache (closes content pipeline →
  dataLevel full); fire-and-forget from oddsService.recordDownstream, gated
  by shouldGradeSlate (off in test, GRADE_SLATE_ON_FETCH override)
- NFL/NHL wired: oddsService SPORT_KEYS/SPORT_MARKETS (correct the-odds-api
  keys americanfootball_nfl/icehockey_nhl), proplineAdapter MARKETS, NHL
  MARKET_MAP keys to avoid silent-zero
- rate limiting mounted on 8 public cached routers (odds/parlay 30/min,
  rest 60/min)
- jsonlLogger writes to temp under test (no more dirtied tracked artifact);
  5MB pipeline test given 20s timeout

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/routes/bookComparison.js

@@ -15,8 +15,11 @@
 const express = require('express');
 const bookComparison = require('../services/bookComparisonService');
 const { cacheGet } = require('../utils/redis');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; reads cached odds props).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'Never leave money on the table' };
 

src/routes/content.js

@@ -17,8 +17,11 @@ const express = require('express');
 const template = require('../services/contentTemplateService');
 const formatter = require('../services/contentFormatter');
 const { cacheGet } = require('../utils/redis');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; reads from cache).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'Every post is a free ad' };
 const SUPPORTED = new Set(['nba', 'wnba', 'mlb', 'soccer', 'nfl', 'nhl']);

src/routes/gameLines.js

@@ -31,8 +31,11 @@ const express = require('express');
 const nbaAdapter = require('../services/adapters/tank01NbaAdapter');
 const mlbAdapter = require('../services/adapters/tank01MlbAdapter');
 const scheduleService = require('../services/scheduleService');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; Tank01, cached).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'Lines keep the slate alive' };
 

src/routes/hotlist.js

@@ -11,8 +11,11 @@
 const express = require('express');
 const hotListService = require('../services/hotListService');
 const { loadRosterLogs } = require('../services/rosterLogs');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; pure engine over cached logs).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'Hot right now' };
 

src/routes/lineMovement.js

@@ -11,8 +11,11 @@
 
 const express = require('express');
 const lineSnapshots = require('../services/lineSnapshotService');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; Redis snapshots).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'The market confirms the grade' };
 

src/routes/odds.js

@@ -1,8 +1,13 @@
 const express = require('express');
 const { getOdds } = require('../services/oddsService');
 const { MARKET_MAP, ALLOWED_BOOKS } = require('../utils/oddsNormalizer');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle. /odds hits PropLine/odds-api upstream on a
+// cache miss, so it gets the tighter 30/min bucket. Independent per-IP
+// bucket scoped to this router (createRateLimit allocates its own Map).
+router.use(createRateLimit({ windowMs: 60_000, max: 30 }));
 
 const VALID_STAT_TYPES = new Set(Object.values(MARKET_MAP));
 const VALID_BOOKS = ALLOWED_BOOKS;

src/routes/parlay.js

@@ -14,8 +14,11 @@
 
 const express = require('express');
 const parlayService = require('../services/parlayService');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle. Parlay math is computation-heavy → 30/min.
+router.use(createRateLimit({ windowMs: 60_000, max: 30 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'Catch the legs that fight each other' };
 

src/routes/schedule.js

@@ -22,8 +22,11 @@
 const express = require('express');
 const scheduleService = require('../services/scheduleService');
 const { SPORT_CONFIG } = require('../config/sports');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; ESPN is free but be respectful).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'The slate is never empty' };
 

src/routes/streaks.js

@@ -15,8 +15,11 @@
 const express = require('express');
 const streaksService = require('../services/streaksService');
 const { loadRosterLogs } = require('../services/rosterLogs');
+const { createRateLimit } = require('../middleware/rateLimit');
 
 const router = express.Router();
+// Session 32 — public throttle (60/min; pure engine over cached logs).
+router.use(createRateLimit({ windowMs: 60_000, max: 60 }));
 
 const MISSION_HEADER = { 'X-VYNDR-Mission': 'Streaks are the heartbeat' };