Request Claim

New user requests to be linked to a placeholder.

Loop 6 Finding #L6-24 (HIDDEN GEM, CRITICAL): previously any authenticated user could POST a claim-request against ANY placeholder_id without any server-side eligibility check. The UI used /claim-suggestions to surface plausible matches but the actual request endpoint was unprotected — a motivated attacker could enumerate placeholder IDs and mass-request them, hoping some owners tap confirm without scrutiny. On confirm, the attacker lands inside the victim's intimate circle (Family, Close Friends) with whatever trust level the placeholder had. This breaks the circles-as- human-circles guarantee directly.

Fix: enforce the SAME eligibility rules the suggestion UI uses — require at least one of (email match, phone match, name substring match) between the caller and the placeholder. Also: rate-limit per user to block enumeration; block re-requests on recently-rejected claims.