feat(api): implement rate limiting and SSRF protection across endpoints

- Added rate limiting to `reaction-users`, `search`, and `image-proxy` APIs to prevent abuse.
- Introduced SSRF protection in `image-proxy` to block requests to private IP ranges.
- Enhanced `link-preview` to use `linkedom` for HTML parsing and improved meta tag extraction.
- Refactored authentication checks in various pages to utilize middleware for cleaner code.
- Improved JWT key loading with error handling and security warnings for production.
- Updated `authFetch` utility to handle token refresh more efficiently with deduplication.
- Enhanced rate limiting utility to trust proxy headers from known sources.
- Numerous layout / design changes

src/components/AudioPlayer.jsx

@@ -749,7 +749,7 @@ export default function Player({ user }) {
 
             <div className="music-time flex justify-between items-center mt-4">
               <p className="music-time__current text-sm">{formatTime(elapsedTime)}</p>
-              <p className="music-time__last text-sm">{formatTime(trackDuration - elapsedTime)}</p>
+              <p className="music-time__last text-sm">-{formatTime(trackDuration - elapsedTime)}</p>
             </div>
 
             <div className="progress-bar-container w-full h-2 rounded bg-neutral-300 dark:bg-neutral-700 overflow-hidden">