security: harden API and WebSocket rate limits

[khemssharma]

What this changes

• Add Redis-backed rate limits for Stockfish analysis, AI analysis/chat/session, and puzzle attempts.
• Keep auth brute-force protection in place with configurable limits.
• Add Redis-shared WebSocket connection caps per authenticated user and IP.
• Reject invalid JWTs on WebSocket connections instead of downgrading them to anonymous guests.
• Fail closed for protected Redis-backed rate-limit/connection-limit checks.

Default limits

• Auth: 20 requests / 15 minutes / IP
• Stockfish analysis: 10 / minute / authenticated user
• AI endpoints: 20 / minute / authenticated user
• Puzzle attempts: 30 / minute / authenticated user
• WebSockets: 5 / user, 20 / IP

Limits can be overridden with environment variables.

Safety

This PR targets the hardening branch only and does not modify main.