feat(api): Implement Zod runtime validation and strict rate limiting

[Diwakar-odds]

Summary

The Next.js API routes (like /api/issues/feed/route.ts) parse req.json() directly without runtime validation. Furthermore, there is no rate limiting on endpoints that wrap the GitHub API, leaving the system vulnerable to abuse and exhaustion of rate limits.

Motivation

Adding robust Zod runtime validation and an Upstash/Redis rate limiting layer constitutes core backend security hardening and reliability improvements, satisfying L3 security criteria.

Changes Required

• Integrate zod for request payload validation.
• Integrate @upstash/ratelimit and @vercel/kv for distributed rate limiting.
• Refactor the /api/issues/feed POST route to validate the languages and page parameters via Zod.
• Apply a fixed-window rate limiter to reject excessive requests with 429 status codes.

[Diwakar-odds]

I am requesting assignment for this issue. This task involves significant backend security hardening and API reliability (L3).

Technical Implementation Plan:

1. Dependencies: Install zod, @upstash/ratelimit, and @vercel/kv.
2. Schema Definition: Create types/schemas.ts defining a strict Zod schema for the feed request (e.g., ensuring languages is an array of strings, page is a positive integer).
3. Validation Layer: Update app/api/issues/feed/route.ts to schema.parse(await req.json()), wrapping it in a try-catch to return 400 Bad Request on failure.
4. Rate Limiting: Instantiate an Upstash rate limiter (e.g., 20 requests per minute per IP). Apply the limiter at the top of the route handler, returning 429 if the limit is exceeded.
5. Testing: Verify validation failure responses and rate limit enforcement locally.

[Sparkyyy45]

@Diwakar-odds pls go ahead