fix(security): require auth + rate limit for /api/ai/roast (#3160)

[geethika-sandireddy]

Summary

Adds authentication, per-user rate limiting, and short response caching to /api/ai/roast so unauthenticated users cannot abuse Gemini credits.

Closes #3160

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that changes existing behavior)
• 📝 Documentation update
• ♻️ Refactor / code cleanup (no functional change)
• ⚡ Performance improvement
• 🔒 Security fix
• 🧪 Tests only

---

What Changed

• Added src/app/api/ai/roast/route.ts implementing:
  - server session check (401 if unauthenticated)
  - per-user rate limiting (Upstash fixed-window 5 requests / 1 hour with in-memory fallback)
  - short response caching (5 minute TTL; Upstash Redis if configured, otherwise memory)

• (Optional) package.json dependency additions if Upstash is desired:
  - "@upstash/redis"
  - "@upstash/ratelimit"

---

How to Test

1. POST /api/ai/roast without signing in:
   -Expected result: 401 Unauthorized
2. Sign in (use a valid account) and POST /api/ai/roast with a valid JSON body (example: {"mode":"roast","stats":{"commits":1,"languages":["ts"]}}):
   -Expected result: 200 with generated result
3. Send >5 authenticated requests within 1 hour from same user:
   -Expected result: 429 Too many requests with retryAfter
4. Send the same authenticated request twice within 5 minutes:
   -Expected result: second response returns cached result (response includes cached: true)

---

Checklist

• Linked the related issue above
• Self-reviewed my own diff
• No unnecessary console.log, debug code, or commented-out blocks
• npm run lint passes locally
• No TypeScript errors (npm run type-check)
• Added or updated tests where applicable
• Updated documentation / comments if behavior changed

---

Additional Context

• Rate limiting uses Upstash Redis when UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN are configured; otherwise an in-memory fallback is used (per-process).
• Cache TTL is 5 minutes to avoid repeated Gemini calls for identical inputs.
• If CI fails due to missing packages, add @upstash/redis and @upstash/ratelimit to package.json on the same branch.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus