Follow-up: citation quota enforcement (deferred from 00)

[OsamaShihadaMedDev]

Summary

Deferred from 00 — accepted gap, not a bug. citation_usage has the same client-write flaw fixed for usage_records in #3: use-citation-usage.ts:111-121 upserts the user's own count, and get-citations does no auth. Anon citation counting lives purely in localStorage (sb_anon_citation).

Deferred because abuse burns NCBI rate limits, not OpenRouter spend (PRD §Non-goals).

When picked up

Apply the #2/#3 pattern to get-citations:

• JWT verification (reuse the Fix 1 approach)
• Atomic consume via the consume_usage RPC family (decide: fold citation_usage into usage_records with kind='citation', or keep the separate table + same policy swap)
• Revoke client INSERT/UPDATE on citation_usage; keep SELECT for display
• Re-verify tiers: anon 1/day, free 3/day, Pro unlimited
• Decide fate of the anon localStorage counter

Trigger to prioritize

NCBI rate-limit pressure, or any feature that makes citations expensive (e.g. per-citation AI processing).