fix(api): add rate limiting, file size validation, and timeout handling

- Add Content-Length header check for early file size validation on audio upload
- Add rate limiting (60 req/min) to public watch endpoint
- Add 10-second timeout with AbortController for YouTube and Vimeo oEmbed requests
- Add automatic rate limit cleanup interval for self-hosted servers
- Fix null check for comment.replies in video page content
- Add checkWorkspaceAccess helper for workspace authorization

lib/auth.ts

@@ -125,3 +125,33 @@ export async function checkProjectAccess(
     canDelete,
   };
 }
+
+// Helper to check workspace access
+export async function checkWorkspaceAccess(
+  workspace: { id: string; ownerId: string },
+  userId: string | undefined
+) {
+  const isOwner = userId === workspace.ownerId;
+
+  // Get workspace membership
+  const workspaceMember = userId
+    ? await db.workspaceMember.findUnique({
+        where: { workspaceId_userId: { workspaceId: workspace.id, userId } },
+      })
+    : null;
+  const isMember = !!workspaceMember;
+  const isAdmin = workspaceMember?.role === WorkspaceMemberRole.ADMIN;
+
+  const hasAccess = isOwner || isMember;
+  const canEdit = isOwner || isAdmin;
+  const canDelete = isOwner;
+
+  return {
+    isOwner,
+    isMember,
+    isAdmin,
+    hasAccess,
+    canEdit,
+    canDelete,
+  };
+}