Security/secure roast route

[Honey-pg]

Summary

Secures the /api/ai/roast route by enforcing session checks, mapping requests to resolved app users, applying a rate limit of 5 requests per hour, and caching identical stats-based roasts/hype responses for 5 minutes.

Closes #3160

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that changes existing behavior)
• 📝 Documentation update
• ♻️ Refactor / code cleanup (no functional change)
• ⚡ Performance improvement
• 🔒 Security fix
• 🧪 Tests only

---

What Changed

• src/app/api/ai/roast/route.ts: Added getServerSession checks, mapped requests to users via resolveAppUser, implemented Upstash Redis rate limiting with a memory limiter fallback (5 req/hour), and implemented a 5-minute cache keyed by user ID, mode, and stats hash.
• public/openapi.yaml: Documented the new 429 (Rate limit exceeded) response.

---

How to Test

1. Send an unauthenticated request to /api/ai/roast. Verify it returns 401 Unauthorized.
2. Authenticate and send a valid POST request with stats. Verify the roast/hype response is generated.
3. Submit the identical request again. Verify it returns the cached response (returns cached: true internally and bypasses Gemini API generation).
4. Send more than 5 requests within an hour. Verify the route returns 429 Rate limit exceeded with a Retry-After header.

Expected result: The route is fully protected against anonymous spam and duplicate calls.

---

Checklist

• Linked the related issue above
• Self-reviewed my own diff
• No unnecessary console.log, debug code, or commented-out blocks
• npm run lint passes locally
• No TypeScript errors (npm run type-check)
• Added or updated tests where applicable
• Updated documentation / comments if behavior changed

Additional Context

• The cache implementation sorts the languages list before generating the hash to guarantee that identical stats payloads in different ordering produce the same cache key.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus