fix(api): restrict public GitHub stats proxy - #461

Motivation

• Close an unauthenticated arbitrary-repo GitHub proxy that used the deployment GITHUB_PUBLIC_TOKEN and could be abused to exhaust upstream quota and grow an unbounded cache.
• Ensure the website-facing stats endpoint only serves the intended jsonbored/gittensory chip and cannot be abused via varying owner/repo path segments.

Description

• Add explicit allowlisting by introducing PUBLIC_REPO_STATS_OWNER/PUBLIC_REPO_STATS_REPO and reject non-allowlisted owner/repo values in publicRepoFullName (in src/github/public.ts) so arbitrary repo requests return 400 before any GitHub fetch.
• Normalize the rate-limit key for the public stats route in rateLimitKey (in src/auth/rate-limit.ts) by mapping /v1/public/github/repos/:owner/:repo/stats to a canonical path so varying owner/repo do not create separate rate-limit buckets.
• Update the OpenAPI source (src/openapi/spec.ts) and generated UI OpenAPI (apps/gittensory-ui/public/openapi.json) to document that only JSONbored/gittensory is accepted and non-allowlisted requests produce 400.
• Add regression tests: integration test to assert non-allowlisted public stats paths are rejected without calling fetch and a unit test asserting rate-limit key normalization for the public stats route (files under test/integration and test/unit).

Testing

• Ran npx vitest run test/integration/api.test.ts test/unit/auth.test.ts test/unit/openapi.test.ts --reporter=verbose and all tests passed.
• Ran type checks with npm run typecheck and the project compiled with no type errors.
• Ran the UI OpenAPI check with npm run ui:openapi:check and it completed successfully.

Codex Task