fix: return valid redirect url on auth rate-limit JSON response (#2267)

[yachikadev]

Summary

Fixes the GitHub sign-in flow showing a raw JSON error instead of a friendly message when the auth rate limiter is triggered by an interrupted-then-retried sign-in attempt (e.g. hitting Back mid-authorization and clicking "Sign in with GitHub" again).

closes #2267

Root Cause

src/middleware.ts handles auth rate-limit hits differently depending on the request type:

• Full page navigation (Accept: text/html) → redirects gracefully to /auth/signin?error=...
• Fetch/XHR request → returns a bare JSON body with no url field

The GitHub sign-in button calls signIn("github", { redirect: false }), which always goes through the fetch path. NextAuth's client-side handler expects every response to include a url field — without it, parsing silently breaks and the raw JSON leaks straight to the screen instead of becoming a toast.

Changes

• src/middleware.ts
  Rate-limit JSON responses now always include a valid url (pointing to /auth/signin?error=RateLimitError) and use the RateLimitError code, which maps correctly to the existing message in AUTH_ERROR_MESSAGES.
• src/lib/auth-rate-limit.ts
AUTH_LIMIT increased from 5 to 8 requests per 15-minute window — enough headroom for a legitimate interrupted-retry attempt, without weakening brute-force protection.

Before → After

Scenario	Before	After
Rate limit hit via full page load	Graceful redirect ✅	Graceful redirect ✅
Rate limit hit via signIn({redirect:false})	Raw JSON on screen ❌	Friendly toast ✅

Notes

• Scoped entirely to the auth rate-limiting path (src/middleware.ts, src/lib/auth-rate-limit.ts) to directly match the issue's repro steps.
• src/app/auth/signin/page.tsx needed no changes — its existing try/catch + toast.error handling now works correctly once the response shape is fixed upstream.

[github-actions]

GSSoC Label Checklist 🏷️

@Priyanshu-byte-coder — please apply the appropriate labels before merging:

Difficulty (pick one):

• level:beginner — 20 pts
• level:intermediate — 35 pts
• level:advanced — 55 pts
• level:critical — 80 pts

Quality (optional):

• quality:clean — ×1.2 multiplier
• quality:exceptional — ×1.5 multiplier

Validation (required to score):

• gssoc:approved — counts for points
• gssoc:invalid / gssoc:spam / gssoc:ai-slop — does not score

Type labels (type:*) are auto-detected from files and title. Review and adjust if needed.
Points formula: (difficulty × quality_multiplier) + type_bonus