fix(security): enforce response-size limits on public analytics endpoints

[Emmycivity]

Overview

This PR enforces bounded response sizes on public analytics endpoints, preventing unbounded collection allocations from user-supplied limit parameters. It centralizes validation in a shared limit helper, applies route-specific defaults and maximums, preserves aggregate statistics, and returns generic validation errors without leaking internal details.

Related Issue

Closes the reported response-size limit security issue for public analytics endpoints.

Changes

🔒 Response-Size Limit Enforcement

• [ADD] web/src/lib/limits.ts

  • Compact shared helper for parsing limit, defaultLimit, and maxLimit.
  • Coerces query-string values, rejects malformed input, and caps requested limits at the route maximum.
  • Emits a clear validation response when a requested limit exceeds the supported maximum.
  • No database/implementation details are included in error responses.

• [MODIFY] Public analytics route limits

  • web/src/app/api/events/route.ts — explicit default and response-size cap for event rows.
  • web/src/app/api/ecosystem-intelligence/route.ts — bounded detailed intelligence rows while preserving aggregates.
  • web/src/app/api/activity/route.ts — explicit default and maximum activity items.
  • web/src/app/api/leaderboard/route.ts — explicit default and maximum ranked entries.
  • web/src/app/api/proposals/route.ts — bounded proposal rows with max-limit validation.
  • web/src/app/api/dashboard/route.ts — detailed rows bounded; aggregate statistics remain available.

• [ADD] Focused route tests

  • Cover default limit behavior, maximum limit behavior, over-limit requests, malformed limit values, and safe error responses.

Verification Results

npm test -- web/src/lib/limits.test.ts
npm test -- web/src/app/api/__tests__/analytics-limits.test.ts
✅ 24/24 passed

Existing analytics suite:
✅ All tests passed

Live acceptance check:
✅ Default limit applied on all affected endpoints
✅ Maximum limit enforced on all affected endpoints
✅ Over-limit request returns clear validation response
✅ Malformed limit returns safe validation behavior
✅ Error responses contain no database/implementation details

Acceptance Criteria	Status
Every affected endpoint has an explicit default and maximum limit	✅ All six public analytics routes now use shared defaults/caps
The server never allocates an unbounded collection based on user input	✅ parseLimit caps every endpoint before query execution
Existing response fields remain backward compatible	✅ Response shapes are unchanged; only row counts are bounded
Tests cover default, maximum, over-limit, and malformed-limit behavior	✅ 24 focused route tests pass
Error responses do not expose database or implementation details	✅ Generic validation messages only

Closes #417

[vercel]

@Emmycivity is attempting to deploy a commit to the Cankat's projects Team on Vercel.

A member of the Team first needs to authorize it.