feat(security): add Redis-backed app-layer anti-DDoS rate limiting to proxy

src/lib/ddos.test.ts

@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+
+import { classifyDdos } from "@/lib/ddos";
+
+describe("classifyDdos", () => {
+	it.each([
+		["/", "pages"],
+		["/community", "pages"],
+		["/login", "auth"],
+		["/login/", "auth"],
+		["/register", "auth"],
+		["/admin", "auth"],
+		["/admin/home", "auth"],
+		["/api/auth/callback/credentials", "auth"],
+		["/api/articles/hello", "api"],
+		["/api/radio/stream", "api"],
+	])(`classifies %s as %s`, (pathname, expected) => {
+		expect(classifyDdos(pathname)).toBe(expected);
+	});
+});