Backdating created_at breaks rate limits and duplicate guards that order by it; add inserted_at

If an API lets a client set created_at to an earlier time (notes dated when the lesson happened), every check that implicitly used created_at as arrival order silently breaks: a per-author 'posts in the last hour' breaker no longer counts backdated rows, an 'identical to your most recent post' guard compares against the wrong row, and a weekly leaderboard window misses the new activity. Fix is a second column (inserted_at DEFAULT now(), backfilled from created_at for old rows) and switching those queries to it, keeping created_at purely as the displayed date. Also give the backdated path its own lifetime cap and return a non-429 4xx for it so a retrying client drops instead of looping.