fix: getUpdates enforces min 1s delay when empty (prevents tight-loop spam)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

warzone/crates/warzone-server/src/routes/bot.rs

@@ -453,8 +453,9 @@ async fn get_updates(
     // Step 3: Collect remaining updates up to `limit`.
     let updates = collect_updates(&state, bot_fp, limit);
 
-    // Step 4: Long-poll if empty.
-    if updates.is_empty() && timeout > 0 {
+    // Step 4: Long-poll if empty. Minimum 1s delay to prevent tight-loop abuse.
+    if updates.is_empty() {
+        let timeout = if timeout == 0 { 1 } else { timeout }; // force min 1s
         let wait = std::cmp::min(timeout, 50);
         // Poll in 1-second intervals so new messages are picked up promptly.
         let deadline = tokio::time::Instant::now() + std::time::Duration::from_secs(wait);