Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@src/modules/events.js`:
- Around line 98-108: Wrap the two moderation pre-checks (the calls to
checkRateLimit(message, guildConfig) and checkLinks(message, guildConfig)
guarded by guildConfig.moderation?.enabled) in a local try/catch so any thrown
error is caught and the listener doesn't reject; in the catch, call your logger
(or processLogger) with context including the function/listener name, the
message id or author, and guild id, then safely continue (or return) without
rethrowing so a single failing check cannot crash the event handler.

In `@src/modules/linkFilter.js`:
- Around line 148-156: Normalize configured blocked domain entries before
matching: when building blockedDomains (used in the link filtering loop that
calls extractUrls and compares hostname to blocked), map lfConfig.blockedDomains
to a normalized list by trimming whitespace, lowercasing, removing a leading
"www." (and any trailing dot), and then use that normalized array in the
matching logic; keep hostname normalization as-is and compare hostname ===
blocked || hostname.endsWith(`.${blocked}`) against the normalizedBlocked list
instead of the raw lfConfig entries.

In `@src/modules/rateLimit.js`:
- Around line 62-63: The mute alert embed currently hard-codes "3 triggers in 5
minutes"; update handleRepeatOffender (and the other embed constructions at the
locations referenced) to build the reason string from the config values instead:
use config.triggerCount and convert the window (e.g., config.windowMinutes or
config.windowMs -> minutes) dynamically and include the muteDurationMs
(formatted to minutes/seconds as appropriate) so the embed reason reflects the
actual config (e.g., `${config.triggerCount} triggers in ${windowMinutes}
minutes`), replacing the hard-coded text wherever it appears (lines around
handleRepeatOffender and the other two embed usages).
- Around line 109-113: In warnUser, don't call message.reply directly; replace
that raw reply with the project's safe message helper (e.g., safeSend or
safeReply) to ensure mention sanitization and allowedMentions enforcement:
update the import/require to pull in the safe helper, call safeSend/safeReply in
place of message.reply with the same composed text, and preserve the existing
catch behavior (returning null) so behavior and error handling remain
consistent; reference the warnUser function and the safeSend/safeReply helper
when making the change.

In `@tests/modules/linkFilter.test.js`:
- Around line 185-249: Add a regression test in the existing "checkLinks —
blocklist matching" suite to verify mixed-case entries in blockedDomains are
matched case-insensitively: create a config via makeConfig({ blockedDomains:
['Evil.COM'] }), a message via makeMessage({ content: 'https://evil.com/path'
}), call checkLinks(msg, config) and assert result.blocked is true (and
optionally expect(msg.delete).toHaveBeenCalledTimes(1)). Place the new it(...)
near the other blocklist tests so it uses the same helpers (checkLinks,
makeConfig, makeMessage) and ensures domain matching is normalized.

In `@tests/modules/rateLimit.test.js`:
- Around line 292-315: The test never triggers eviction because it never exceeds
the module's MAX_TRACKED_USERS; update the test to actually exercise eviction by
either (a) temporarily lowering the module's MAX_TRACKED_USERS (mock or set the
exported constant) before the loop so checkRateLimit is called enough times to
exceed that smaller cap and then assert getTrackedCount() <= that cap, or (b)
modify the rate-limit implementation to accept a cap via config (e.g., add a
maxTrackedUsers option consumed by checkRateLimit) and in the test pass a small
cap so the eviction path runs; target the checkRateLimit, getTrackedCount and
MAX_TRACKED_USERS (or new config option) symbols when making the change.

Fix the following issues on branch feat/rate-limit-link-filter in VolvoxLLC/volvox-bot:

1. src/modules/rateLimit.js:111-117 — Replace `message.reply()` with `safeReply(message, ...)` from `../utils/safeSend.js`. Add `safeReply` to the import on line 9.

2. src/modules/rateLimit.js:50 and src/modules/linkFilter.js:81 — The `isExempt` function checks `config.permissions?.modRoles` which doesn't exist in config.json. Either: (a) add `"modRoles": []` to the `permissions` section of `config.json`, or (b) refactor `isExempt` to use the existing `isModerator()` from `src/utils/permissions.js` which already checks `adminRoleId`, `moderatorRoleId`, and `PermissionFlagsBits.Administrator`.

3. src/modules/events.js:98-108 — Wrap both moderation pre-checks (checkRateLimit + checkLinks) in a single `if (guildConfig.moderation?.enabled)` block with a try/catch. In the catch, call `logError('Moderation pre-check failed', { guildId, channelId, userId, error })`.

4. src/modules/linkFilter.js:150 — Normalize blockedDomains entries: `.map(d => d.toLowerCase().trim()).filter(Boolean)`.

5. src/modules/rateLimit.js:98 — Replace hard-coded "3 triggers in 5 minutes" with values from config: `${muteThreshold} triggers in ${Math.round(muteWindowSeconds / 60)} minute(s)`. Thread muteThreshold and muteWindowSeconds into handleRepeatOffender.

6. src/modules/rateLimit.js:69 — Change `'ModerateMembers'` to `PermissionFlagsBits.ModerateMembers`.

7. Extract the duplicated `isExempt` function from rateLimit.js:43-56 and linkFilter.js:75-87 into a shared utility in src/utils/ and import it in both files.

8. config.json — Add rateLimit and linkFilter config sections inside the "moderation" block (after line 80), both with "enabled": false by default.

9. AGENTS.md — Add these entries to the Key Files table:
   - `src/modules/rateLimit.js` | Rate limiting — sliding window per user/channel with progressive escalation
   - `src/modules/linkFilter.js` | Link filtering — domain blocklist + phishing pattern detection

10. tests/modules/rateLimit.test.js:296-319 — Make the memory cap test actually trigger eviction. Either export a setter for MAX_TRACKED_USERS from rateLimit.js for testing, or create 10,001 unique users in the test to trigger the eviction path, then assert getTrackedCount() <= 10000.

11. tests/modules/linkFilter.test.js — Add a regression test for mixed-case blockedDomains: `makeConfig({ blockedDomains: ['Evil.COM'] })` with message `'https://evil.com/path'` should still block.