Description

app/api/og/route.tsx has zero rate limiting. This endpoint is embedded in
every page's tag, meaning every social media bot (Twitter,
Discord, Slack, LinkedIn) that crawls a shared CommitPulse link fires a fresh
fetchGitHubContributions call against the GitHub API.

A single viral post or coordinated scraping can exhaust the entire GitHub API
quota in minutes, taking down /api/streak and /api/stats for all users
globally since they share the same token pool.

Every other API route in this codebase (/api/notify, /api/reviews,
/api/ci-analytics, /api/webhook) has per-IP rate limiting. /api/og
is the only one that doesn't.

Steps to Reproduce

1. Share any CommitPulse user URL on Twitter, Discord, or Slack
2. Social media bots immediately crawl the og:image URL (/api/og?user=...)
3. Each bot crawl fires a fresh GitHub GraphQL request
4. With enough shares or a coordinated scrape, GitHub API quota is exhausted
5. All users see rate limit errors on /api/streak and /api/stats

Expected Behavior

/api/og should enforce per-IP rate limiting (e.g. 30 requests/minute)
consistent with every other API route in the codebase. Requests exceeding
the limit should return 429 Too Many Requests instead of firing GitHub API calls.

Screenshots / Logs

No response

GitHub Username (If applicable)

No response

Environment

Other