test : added unit tests for rate-limit utility functions

[tmdeveloper007]

Closes #2627.

Summary of What Has Been Done:
Added test/rate-limit.test.ts covering the exported utility functions from src/lib/rate-limit.ts: getClientIp and createMemoryFixedWindowRateLimiter. All 14 tests pass under vitest.

Changes Made:

• New file: test/rate-limit.test.ts (14 tests).
• getClientIp: cf-connecting-ip priority, x-real-ip fallback, x-forwarded-for first-IP extraction, no-headers returns unknown, empty-header returns unknown, whitespace trimming.
• createMemoryFixedWindowRateLimiter: allows within limit, denies at limit, per-key isolation, window expiry resets the counter, returns correct reset unix timestamp.

Impact it Made:
Locks the contract for the in-memory rate limiter used by auth and metrics API routes. The limiter prevents abuse of /api/auth/* and /api/metrics/* endpoints. Future changes to window timing or bucket management will surface a test failure rather than silently allowing rate-limit bypass.

[github-actions]

GSSoC Label Checklist 🏷️

@Umbrella-io — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus

[Priyanshu-byte-coder]

CI is failing on this PR. Please fix the TypeScript/test errors before we can merge. Run npm run typecheck and npm test locally to reproduce.

[tmdeveloper007]

This PR has been closed as it has been stale for more than 2 days without recent activity or merging. If this work is still relevant, please reopen a fresh PR.