fix: add input validation, Zod schemas, rate limiting, and IP trust

- Add Zod schema for webhook response parsing (orchestrator.ts)
- Add Zod schemas for POST /respond and /react request bodies
- Add safe integer validation for batch count param
- Prefer cf-connecting-ip over spoofable x-forwarded-for
- Add ID format validation on URL params
- Add rate limiting on /auth/login (30/min) and /update (10/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/auth.ts

@@ -26,8 +26,8 @@ authRouter.get("/check-name/:name", async (c) => {
   return c.json({ available: existing.length === 0 })
 })
 
-// Login with Nostr pubkey
-authRouter.post('/login', async (c) => {
+// Login with Nostr pubkey (rate limited: 30 per minute per IP)
+authRouter.post('/login', rateLimit(60_000, 30), async (c) => {
   const body = await c.req.json()
   const { pubkey } = body
 
@@ -295,7 +295,7 @@ authRouter.post('/register-human', rateLimit(3600_000, 15), async (c) => {
 })
 
 // Update bot webhook and/or customization (requires pubkey match)
-authRouter.post('/update', async (c) => {
+authRouter.post('/update', rateLimit(60_000, 10), async (c) => {
   const body = await c.req.json()
   const { pubkey, webhookUrl, profilePicUrl, customization: rawCustomization } = body