[SECURITY]: Add layered abuse protection for authentication and write APIs

[barry01-hash]

Context

Public authentication, support, payout, application, and upload endpoints can be targeted by automated abuse. A production platform needs controls that work across serverless instances and distinguish anonymous, authenticated, and resource-level limits.

Scope

• Create a distributed rate-limit abstraction with route-specific policies.
• Key limits safely by authenticated actor, IP/network signal, and high-value resource where appropriate.
• Add payload size limits, timeouts, and bounded pagination before expensive parsing/database work.
• Define stricter policies for login/reset, uploads, application creation, and state transitions.
• Return standard 429 responses with retry metadata.
• Add metrics and alerting without storing raw sensitive identifiers.

Acceptance criteria

• Limits are consistent across horizontally scaled instances.
• Proxy/header trust configuration prevents trivial client spoofing.
• Legitimate retries and normal multi-tab use remain functional.
• Load tests demonstrate bounded database/storage traffic during abuse.
• Fail-open versus fail-closed behavior is explicitly decided per endpoint class.
• Operators can tune policies through validated configuration.

Relevant areas

src/app/api/**, middleware, auth flows, file routes, pagination endpoints.

Note

Keep implementation and review focused on defensive controls; do not include live credentials or exploit payloads in PRs.