CogniPrep

The cheapest gate runs first so a flood stops before the Supabase auth call

Every route in CogniPrep passes through five gates whose order is set by what each one costs to fail. The sharper detail in the writeup is the header parsing: the standard x-forwarded-for snippet lets any caller pick its own rate-limit key.