perf: harden quotas and reduce compression overhead

src/services/quota.rs

@@ -527,8 +527,25 @@ fn anonymous_session_key(session_id: &str, date: NaiveDate) -> String {
     format!("anon_quota:{session_id}:{}", date.format("%Y-%m-%d"))
 }
 
+pub(crate) fn anonymous_ip_scope(ip: IpAddr) -> String {
+    match ip {
+        IpAddr::V4(ip) => ip.to_string(),
+        IpAddr::V6(ip) => {
+            if let Some(mapped) = ip.to_ipv4_mapped() {
+                return mapped.to_string();
+            }
+            let network = std::net::Ipv6Addr::from(u128::from(ip) & (u128::MAX << 64));
+            format!("{network}/64")
+        }
+    }
+}
+
 fn anonymous_ip_key(ip: IpAddr, date: NaiveDate) -> String {
-    format!("anon_quota_ip:{ip}:{}", date.format("%Y-%m-%d"))
+    format!(
+        "anon_quota_ip:{}:{}",
+        anonymous_ip_scope(ip),
+        date.format("%Y-%m-%d")
+    )
 }
 
 fn utc8_date() -> NaiveDate {
@@ -601,4 +618,19 @@ mod tests {
             "anon_quota_ip:127.0.0.1:2026-07-25"
         );
     }
+
+    #[test]
+    fn anonymous_ipv6_addresses_share_a_slash_64_scope() {
+        let first: IpAddr = "2001:db8:1234:5678::1".parse().unwrap();
+        let second: IpAddr = "2001:db8:1234:5678:ffff::99".parse().unwrap();
+        let other: IpAddr = "2001:db8:1234:5679::1".parse().unwrap();
+
+        assert_eq!(anonymous_ip_scope(first), "2001:db8:1234:5678::/64");
+        assert_eq!(anonymous_ip_scope(first), anonymous_ip_scope(second));
+        assert_ne!(anonymous_ip_scope(first), anonymous_ip_scope(other));
+        assert_eq!(
+            anonymous_ip_scope("::ffff:203.0.113.7".parse().unwrap()),
+            "203.0.113.7"
+        );
+    }
 }