feat(api): implement rate limiting and SSRF protection across endpoints

- Added rate limiting to `reaction-users`, `search`, and `image-proxy` APIs to prevent abuse.
- Introduced SSRF protection in `image-proxy` to block requests to private IP ranges.
- Enhanced `link-preview` to use `linkedom` for HTML parsing and improved meta tag extraction.
- Refactored authentication checks in various pages to utilize middleware for cleaner code.
- Improved JWT key loading with error handling and security warnings for production.
- Updated `authFetch` utility to handle token refresh more efficiently with deduplication.
- Enhanced rate limiting utility to trust proxy headers from known sources.
- Numerous layout / design changes

src/env.d.ts

@@ -1 +1,17 @@
 /// <reference path="../.astro/types.d.ts" />
+
+// Extend Astro.locals with custom properties set by middleware
+declare namespace App {
+  interface Locals {
+    user?: {
+      id?: string;
+      username?: string;
+      user?: string;
+      roles?: string[];
+      [key: string]: unknown;
+    };
+    whitelabel?: string | null;
+    isSubsite?: boolean;
+    refreshedCookies?: string[];
+  }
+}