Replace the loose '30/minute' cap with a layered '5/minute;20/hour;30/day'
on both /query and /ui/query. Same key (remote IP) on all three windows;
slowapi enforces them independently and the most restrictive wins.
Worst-case spend per IP per day: 30 queries x ~$0.011 (max_tokens=2048
on claude-haiku-4-5) = ~$0.33. Comfortably under the $1 ceiling and
still leaves room for a legitimate evaluator to try a handful of queries
in a single sitting.
Wire a fourth source type through the retrieval, API, UI, and eval
dashboard layers:
- api/hybrid.py: add 'icd12' to SOURCE_TYPES so per-source retrieval
fans out to it alongside mtsamples, pubmed, icd11.
- api/main.py: add 'icd12' to the SourceType Literal so the JSON API
accepts it in source_types filters.
- api/templates/_results.html: amber chip treatment for icd12 hits.
- api/static/eval.js: amber colour + inclusion in the per-query source
mix chart on the /eval dashboard.
Redirect / to /ui (handles bare Space URL + HF healthcheck)
