feat(security): add Redis-backed app-layer anti-DDoS rate limiting to proxy

src/lib/ddos.ts

@@ -0,0 +1,18 @@
+export type DdosCategory = "pages" | "api" | "auth";
+
+export function classifyDdos(pathname: string): DdosCategory {
+	if (
+		pathname === "/api/auth" ||
+		pathname.startsWith("/api/auth/") ||
+		pathname === "/login" ||
+		pathname.startsWith("/login/") ||
+		pathname === "/register" ||
+		pathname.startsWith("/register/") ||
+		pathname === "/admin" ||
+		pathname.startsWith("/admin/")
+	) {
+		return "auth";
+	}
+	if (pathname.startsWith("/api/")) return "api";
+	return "pages";
+}