WATCH-212 · Watchlist endpoints broken after refactor
QA reports that the watchlist feature silently does nothing. Users click Add, see a success toast, but the movie never shows up. Removing returns success even for movies that were never added. The mobile team also says /check/:movieId returns an array instead of a flag.
Product additionally requires rate limiting: a user may add/remove at most 10 times in a rolling 2-minute window; the 11th call must get 429. A teammate started a limiter in middleware/rateLimiter.js but it was never finished.
Definition of done: all tests in tests/watchlist.test.js pass. Don't edit the tests.