feat: implement R2 audio file management and rate limiting enhancements

- Add R2 client setup and audio upload functionality in lib/r2.ts.
- Create audio file cleanup functions in lib/r2-cleanup.ts to delete voice files associated with videos, projects, and workspaces.
- Enhance rate limiting in lib/rate-limit.ts with new action-specific limits and improved IP validation.
- Introduce a unified rate limit check function that returns a 429 response when limits are exceeded.
- Update package.json to include the AWS SDK for S3.

app/api/projects/[projectId]/videos/[videoId]/route.ts

@@ -2,6 +2,8 @@ import { NextRequest, NextResponse } from 'next/server';
 import { db } from '@/lib/db';
 import { auth } from '@/lib/auth';
 import { ProjectMemberRole } from '@prisma/client';
+import { rateLimit } from '@/lib/rate-limit';
+import { cleanupVideoVoiceFiles } from '@/lib/r2-cleanup';
 
 type RouteParams = { params: Promise<{ projectId: string; videoId: string }> };
 
@@ -65,6 +67,9 @@ export async function GET(request: NextRequest, { params }: RouteParams) {
 // PATCH /api/projects/[projectId]/videos/[videoId]
 export async function PATCH(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
         const session = await auth();
         const { projectId, videoId } = await params;
 
@@ -122,6 +127,9 @@ export async function PATCH(request: NextRequest, { params }: RouteParams) {
 // DELETE /api/projects/[projectId]/videos/[videoId]
 export async function DELETE(request: NextRequest, { params }: RouteParams) {
     try {
+        const limited = await rateLimit(request, 'mutate');
+        if (limited) return limited;
+
         const session = await auth();
         const { projectId, videoId } = await params;
 
@@ -152,6 +160,9 @@ export async function DELETE(request: NextRequest, { params }: RouteParams) {
             );
         }
 
+        // Clean up voice files from R2 before cascade delete removes comment rows
+        await cleanupVideoVoiceFiles(videoId);
+
         await db.video.delete({ where: { id: videoId } });
 
         return NextResponse.json({ success: true, message: 'Video deleted' });