fix: prevent CI analytics GitHub quota amplification

[Krishnx21]

Summary

• add a fixed-bucket rate limit to the CI analytics endpoint so rotating usernames cannot obtain fresh buckets
• validate and normalize GitHub usernames before starting analytics work
• bound repository, workflow, and run pagination/fan-out to protect shared GitHub API quotas
• add route and service security regression tests

Verification

• npm run test -- app/api/ci-analytics services/github middleware.test.ts lib/rate-limit.test.ts (52 files, 293 tests passed)
• npm run typecheck
• focused ESLint
• git diff --check
• npm run build attempted; blocked by an existing Windows/OneDrive EPERM lock on .next/diagnostics

Fixes #5224

[vercel]

@Krishnx21 is attempting to deploy a commit to the jhasourav07's projects Team on Vercel.

A member of the Team first needs to authorize it.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 0b4d4f351d

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Aamod-Dev]

Good work on this one. I reviewed the diff and it looks ready to go from my side.

Everything looks good. Approving this now.

[github-actions]

🎉 Congratulations @Krishnx21! Your PR has been successfully merged. 🚀

Thank you for contributing to CommitPulse. Your work helps us build a better tool for the community.

⚠️ Important for GSSoC Contributors:
You are strictly advised to join our Discord Server as it is mandatory for all GSSoC participants. All important announcements, point claims, and community discussions happen there.

Keep building! 💻✨

[Aamod-Dev]

Review Summary
Removed extra type labels ( ype:devops) to strictly meet the rule of exactly one type label ( ype:bug retained).