security: fix SSRF, restrict CORS, add rate limiting on auth endpoints

- Add isPrivateHost() to block image proxy requests to loopback/private/
  link-local IPs (SSRF mitigation)
- Add isAllowedLocalPath() to restrict local file reads to configured
  data/cache/media directories only
- CORS middleware now takes debug flag; wildcard only when debug=true,
  production omits headers (same-origin enforced)
- Add per-IP sliding-window rate limiter (10 req/min) on login/register
  and Emby AuthenticateByName endpoints

Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>

internal/middleware/middleware.go

@@ -6,6 +6,7 @@ import (
 	"errors"
 	"net/http"
 	"strings"
+	"sync"
 	"time"
 
 	"github.com/gin-gonic/gin"
@@ -35,10 +36,12 @@ func RequestLogger(log *zap.Logger) gin.HandlerFunc {
 	}
 }
 
-// CORS implements a permissive cross-origin policy when origins is empty
-// (development convenience) and a strict allow-list otherwise.
-func CORS(origins []string) gin.HandlerFunc {
-	allowAll := len(origins) == 0
+// CORS implements a cross-origin policy. When debug is true and origins is
+// empty, all origins are allowed (dev convenience). In production
+// (debug=false) with an empty origins list, CORS headers are omitted
+// entirely so the browser enforces same-origin by default.
+func CORS(origins []string, debug bool) gin.HandlerFunc {
+	allowAll := len(origins) == 0 && debug
 	allowed := make(map[string]struct{}, len(origins))
 	for _, o := range origins {
 		allowed[strings.TrimSpace(o)] = struct{}{}
@@ -62,6 +65,85 @@ func CORS(origins []string) gin.HandlerFunc {
 	}
 }
 
+// RateLimiter is a simple per-IP sliding-window rate limiter that runs
+// entirely in-process. It is intended for auth endpoints (login, register)
+// where brute-force protection is critical.
+type RateLimiter struct {
+	mu       sync.Mutex
+	window   time.Duration
+	max      int
+	requests map[string][]time.Time
+}
+
+// NewRateLimiter creates a rate limiter allowing max requests per window
+// per client IP.
+func NewRateLimiter(max int, window time.Duration) *RateLimiter {
+	rl := &RateLimiter{
+		window:   window,
+		max:      max,
+		requests: make(map[string][]time.Time),
+	}
+	go rl.cleanup()
+	return rl
+}
+
+func (rl *RateLimiter) cleanup() {
+	for {
+		time.Sleep(5 * time.Minute)
+		rl.mu.Lock()
+		now := time.Now()
+		for ip, times := range rl.requests {
+			var valid []time.Time
+			for _, t := range times {
+				if now.Sub(t) <= rl.window {
+					valid = append(valid, t)
+				}
+			}
+			if len(valid) == 0 {
+				delete(rl.requests, ip)
+			} else {
+				rl.requests[ip] = valid
+			}
+		}
+		rl.mu.Unlock()
+	}
+}
+
+// Allow returns true if the request from ip is within the rate limit.
+func (rl *RateLimiter) Allow(ip string) bool {
+	rl.mu.Lock()
+	defer rl.mu.Unlock()
+	now := time.Now()
+	times := rl.requests[ip]
+	var valid []time.Time
+	for _, t := range times {
+		if now.Sub(t) <= rl.window {
+			valid = append(valid, t)
+		}
+	}
+	if len(valid) >= rl.max {
+		rl.requests[ip] = valid
+		return false
+	}
+	rl.requests[ip] = append(valid, now)
+	return true
+}
+
+// RateLimit returns a Gin middleware that rejects requests exceeding the
+// per-IP rate limit with 429 Too Many Requests.
+func RateLimit(limiter *RateLimiter) gin.HandlerFunc {
+	return func(c *gin.Context) {
+		if !limiter.Allow(c.ClientIP()) {
+			c.AbortWithStatusJSON(http.StatusTooManyRequests, gin.H{
+				"code":    42901,
+				"message": "too many requests, please try again later",
+			})
+			return
+		}
+		c.Next()
+	}
+}
+
 // Claims is the JWT payload we issue.
 type Claims struct {
 	UserID string `json:"uid"`