POST /shorten and GET /:code are enforcing each other's rate limits

This project deliberately gives the expensive, abusable operation (POST /shorten -- a Postgres write plus a Redis write) a strict 10-requests/min limit, and the cheap, high-frequency operation (GET /:code -- a redirect real users click constantly) a loose 60-requests/min limit. Right now the two are swapped. The practical effect: a short link that gets shared somewhere popular -- a Slack channel, a group chat, anywhere multiple people click it from behind the same office/campus NAT within a minute -- starts throwing 429 Too Many Requests at real visitors after only 10 clicks from that shared IP, even though the whole point of a short link is to be clicked by lots of people. Meanwhile, the endpoint that actually costs a database write per request -- the one this rate limit exists to protect -- now allows 60 creates/min per IP instead of 10, six times the intended abuse budget. This is strictly worse than having no fix at all in either direction: legitimate traffic gets blocked, and the actually expensive endpoint gets weaker protection. Priority is P0 rather than a lower severity-sounding label because this is a security/abuse-control misconfiguration with real production impact in both directions at once, not a cosmetic bug.

POST /shorten is rate-limited using the limiter configured for redirects (60 requests/60s), and GET /:code is rate-limited using the limiter configured for creation (10 requests/60s) -- the two are wired to the wrong routes.

Fire 11 POSTs to /shorten from the same IP within the default 60s window.

for i in $(seq 1 11); do curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost:3003/shorten
-H 'Content-Type: application/json'
-d "{"longUrl":"https://example.com/$i\"}" done

Expected: the 11th request returns 429 (the strict 10/min creation limit).

Actual: all 11 return 201 -- it's using the loose 60/min limit instead.

src/middleware/rateLimiter.js exports two independently-configured limiters, createLimiter (strict) and redirectLimiter (loose) -- that part is correct and doesn't need to change. The bug is entirely in which route file imports which one. Look at the require('../middleware/rateLimiter') line and the limiter passed as middleware in both src/routes/shorten.js's router.post('/shorten', ...) and src/routes/redirect.js's router.get('/:code', ...) -- cross-reference the name of the limiter each file imports against the name the README says each endpoint should use.

Check both files side by side: src/routes/shorten.js and src/routes/redirect.js. Each imports one limiter from ../middleware/rateLimiter and passes it as middleware to its route. Verify which limiter name is bound to which route in each file, and compare that against what the limiter's own name says it's for (createLimiter vs. redirectLimiter).