[P0] `api_publish` bypasses plan limit check — billing bypass

[ShadowWalkerNC]

Summary

/api/push_all correctly calls check_platform_limit before publishing, but /api/publish and /api/publish_post do not. A free-tier user can bypass plan enforcement entirely by calling /api/publish directly.

Impact

Billing bypass on a SaaS product. Free users gain unlimited platform access.

Fix

Add check_platform_limit (or a shared @require_plan guard) to /api/publish and /api/publish_post the same way it's applied in api_push_all.

Effort: ~5 minutes

Part of full audit: #1