feat: tiered API plans (Free/Bronze/Gold/Platinum)

- Free: $0, 30 req/min, market data only
- Bronze: $29/mo, 100 req/min, + companies & search
- Gold: $99/mo, 500 req/min, + filings & historical
- Platinum: $299/mo, 2000 req/min, all features + priority
- Plan-aware rate limiting per API key (or per IP for free)
- Usage tracking with daily aggregation
- GET /api/v1/plans — plan listing
- POST /api/v1/plans/register — instant free API key
- GET /api/v1/plans/usage — usage stats
- /pricing — dark-themed HTML pricing page
- X-RateLimit-* and X-Plan headers on every response
- Restricted endpoints return upgrade prompt
- Updated OpenAPI spec with security scheme
- 53 handlers, compiles clean

internal/api/server.go

@@ -21,11 +21,8 @@ func NewServer(cfg *config.Config, database *db.DB) *fiber.App {
 	app.Use(cors.New())
 	RegisterSwagger(app)
 
-	app.Use(middleware.NewRateLimiter(cfg.RateLimit))
-
-	if cfg.APIKey != "" {
-		app.Use(middleware.NewAPIKeyAuth(cfg.APIKey))
-	}
+	// Plan-based rate limiting and access control (replaces old rate limiter + API key auth)
+	app.Use(middleware.NewPlanMiddleware(database))
 
 	RegisterRoutes(app, database)