TL;DR

This PR adds the foundation for REST API endpoints with proper authentication and rate limiting:

• Creates a new /api route structure with middleware for authentication and rate limiting
• Extracts client IP detection into a reusable getClientIp helper with comprehensive tests
• Adds authentication middleware that reuses existing GraphQL auth logic
• Implements rate limiting for API endpoints (10 requests per minute per user/IP)
• Adds extensive test coverage for all new middleware components
• Updates Vite config to proxy /api requests during development

Why make this change?

• Subsequent PR adds an /api/chat route for streaming the chat response from Pair for the AI Builder
• Why not GraphQL with SSE?
  • Requires installing more packages
  • Need to add subscriptions
  • More config changes that this current approach

How to test?

• All existing graphql APIs work as intended
• API calls to /api adhere to authentication and rate-limits requirements
  • Rate limit is 10/user/second (very conservative approach since there is only 1 route, and we don't want to spam the LLM)