fix: session boot on POST path, consolidate rate limiter via checkKey()

TODO.md

@@ -5,3 +5,5 @@
 - [x] Fix regex delimiter clash (`/` inside `[...]` broke the pattern) → switched to `#` delimiter
 - [x] Add PHP dev server router for /partage/<slug> URL rewriting
 - [x] Add nginx location block for /partage/ pretty URLs
+- [x] Fix POST path missing App::boot() (session not started before submission handler)
+- [x] Fix rate limiter: was instantiating RateLimit then ignoring it, reimplementing inline; added checkKey() to RateLimit and use it