news: clamp free + anonymous to last 6h; paid keeps 24h

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/services/access.py

@@ -22,6 +22,10 @@ from fastapi import Depends, HTTPException, status
 from app.auth import CurrentUser, require_auth
 from app.models import User
 
+# How many hours of news the free tier sees. Paid sees whatever the
+# endpoint's `since_hours` param requests (up to its own max).
+FREE_NEWS_WINDOW_HOURS = 6.0
+
 
 def _utcnow() -> datetime:
     return datetime.now(timezone.utc)