feat(watch): add pause and visibility change progress saving with rate limiting

- Save watch progress immediately when video is paused using player instance directly
- Save progress when tab becomes hidden (user switches tabs or minimizes)
- Add rate limiting (30/min) to watch progress API endpoint to prevent abuse
- Use player instance directly instead of React state for current time/duration to avoid stale values

app/api/watch/[videoId]/progress/route.ts

@@ -2,6 +2,7 @@ import { NextRequest } from 'next/server';
 import { db } from '@/lib/db';
 import { auth, checkProjectAccess } from '@/lib/auth';
 import { apiErrors, successResponse } from '@/lib/api-response';
+import { rateLimit } from '@/lib/rate-limit';
 
 type RouteParams = { params: Promise<{ videoId: string }> };
 
@@ -69,6 +70,10 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 // POST /api/watch/[videoId]/progress - Save watch progress for the current user
 export async function POST(request: NextRequest, { params }: RouteParams) {
     try {
+        // Rate limit watch progress updates (30 per minute to allow pause + periodic + visibility changes)
+        const limited = await rateLimit(request, 'watch-progress');
+        if (limited) return limited;
+        
         const session = await auth();
         
         if (!session?.user?.id) {