fix: add authentication and rate limiting to AI roast endpoint

[codecrafted1]

Summary

This PR secures the /api/ai/roast API endpoint by adding authentication and per-user rate limiting. These changes prevent unauthenticated abuse of the Gemini API and align the endpoint with the security patterns used by other AI routes.

Closes #3319

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that changes existing behavior)
• 📝 Documentation update
• ♻️ Refactor / code cleanup (no functional change)
• ⚡ Performance improvement
• 🔒 Security fix
• 🧪 Tests only

---

What Changed

• Added session authentication to the /api/ai/roast endpoint using getServerSession(authOptions).
• Resolved the authenticated application user using resolveAppUser before processing AI requests.
• Implemented per-user fixed-window rate limiting with Upstash Redis and an in-memory fallback, returning 429 Too Many Requests when the limit is exceeded.

---

How to Test

1. Send a request to /api/ai/roast without authentication and verify that the API returns 401 Unauthorized.
2. Sign in and send valid requests to the endpoint to ensure AI responses are generated successfully.
3. Exceed the configured request limit and verify that the API returns 429 Too Many Requests along with a Retry-After header.

Expected result:

• Unauthenticated users cannot access the endpoint.
• Authenticated users receive valid AI responses while within the rate limit.
• Requests exceeding the configured limit are blocked with a 429 response.

---

Screenshots / Recordings

Not applicable (backend-only changes).

---

Checklist

• Linked the related issue above
• Self-reviewed my own diff
• No unnecessary console.log, debug code, or commented-out blocks
• npm run lint passes locally
• No TypeScript errors (npm run type-check)
• Added or updated tests where applicable
• Updated documentation / comments if behavior changed

---

Accessibility (UI changes only)

Not applicable.

---

Additional Context

This change follows the existing security approach used by other AI endpoints in the project, helping protect paid AI resources from unauthenticated or excessive usage while maintaining consistent backend behavior.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[codecrafted1]

@Priyanshu-byte-coder , please review this pr