Security/secure project tutor-user can drained groq quota

[Honey-pg]

Summary

Secures the /api/project-tutor route by enforcing session checks, mapping requests to resolved app users, applying input limits (capping URL and question lengths to prevent abuse), establishing a rate limit of 10 requests per hour, and caching analysis and questions results for 6 hours.

Closes #3162

---

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that changes existing behavior)
• 📝 Documentation update
• ♻️ Refactor / code cleanup (no functional change)
• ⚡ Performance improvement
• 🔒 Security fix
• 🧪 Tests only

---

What Changed

• src/app/api/project-tutor/route.ts: Added getServerSession validation (session.githubId), resolved user UUIDs via resolveAppUser, capped repoUrl (200 characters) and question (500 characters) parameter lengths, added Upstash Redis and memory rate-limiting checks (10 req/hour), and implemented a 6-hour cache for analyze and questions actions.
• public/openapi.yaml: Fully documented the /api/project-tutor route endpoint schemas and status responses (200, 400, 401, 429, 500).

---

How to Test

1. Submit a POST request to /api/project-tutor without credentials. Verify it returns 401 Unauthorized.
2. Submit a request with a repoUrl exceeding 200 characters or a chat question exceeding 500 characters. Verify it fails validation and returns 400 Bad Request.
3. Send a valid analyze or questions request. Verify the response contains the tutor analysis or questions list.
4. Send the identical query again. Verify it returns the response immediately from the cache (returns cached: true internally and bypasses Groq API calls).
5. Exceed 10 requests within an hour. Verify the route returns 429 Rate Limit Exceeded along with a Retry-After header.

Expected result: The route is fully hardened against unauthenticated spam, excessive parameter inputs, and repetitive Groq compilation calls.

---

Checklist

• Linked the related issue above
• Self-reviewed my own diff
• No unnecessary console.log, debug code, or commented-out blocks
• npm run lint passes locally
• No TypeScript errors (npm run type-check)
• Added or updated tests where applicable
• Updated documentation / comments if behavior changed

---

Additional Context

• The cache keys are structured as project-tutor-cache:${owner.toLowerCase()}:${repo.toLowerCase()}:${action} to keep matching independent of how the user cases the repository name.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[Priyanshu-byte-coder]

The security work here is genuinely good and exactly the right fix — adding a session check, per-user rate limiting (5/hr with Upstash + in-memory fallback), and stats-hash response caching to /api/ai/roast and /api/project-tutor closes the unauthenticated-Groq/Gemini-quota-drain hole. I want this in.

The problem is scope: this PR also rewrites all six CI workflows (pnpm/action-setup → corepack), overhauls the Dockerfile (node 20→22, new build deps), and edits README.md, docs/self-hosting.md, public/openapi.yaml, package.json, auth.ts and auth-config.ts. That's risky infra change riding in on a security fix — a broken workflow rewrite would take down CI for every PR, and none of it is needed for the quota fix.

Please cut this down to just the two route files (plus any genuinely new rate-limit/cache lib helpers they depend on) and drop the CI/Docker/docs/auth churn. If you think the corepack/Dockerfile changes are worth doing, they can be their own separate PR that we validate on its own. Once this is scoped to the AI-endpoint hardening, it's a merge.