fix(api): add rate limiting, file size validation, and timeout handling

- Add Content-Length header check for early file size validation on audio upload
- Add rate limiting (60 req/min) to public watch endpoint
- Add 10-second timeout with AbortController for YouTube and Vimeo oEmbed requests
- Add automatic rate limit cleanup interval for self-hosted servers
- Fix null check for comment.replies in video page content
- Add checkWorkspaceAccess helper for workspace authorization

lib/rate-limit.ts

@@ -160,6 +160,14 @@ export async function cleanupRateLimits(): Promise<void> {
     }
 }
 
+// Start cleanup interval when the module is loaded (for self-hosted servers)
+// Cleanup runs every 5 minutes to remove expired rate limit entries
+if (typeof setInterval !== 'undefined') {
+    setInterval(() => {
+        cleanupRateLimits().catch(console.error);
+    }, 5 * 60 * 1000);
+}
+
 /**
  * One-call rate limit check that returns a 429 NextResponse if blocked, or null if allowed.
  * Use at the top of any API handler: