Security Hardening & Rate Limiting

[ishvindersethi22]

Description

This PR implements a comprehensive security hardening layer for the Arena Backend, addressing multiple vulnerabilities related to credential exposure, IDOR, and resource abuse.

Key Changes

Secret Management & Infrastructure

• Env Var Migration: Moved SECRET_KEY and DEBUG to environment variables.
• Firebase Security: Moved FIREBASE_CREDENTIALS_PATH to an env var and removed absolute path logging.
• HTTPS Enforcement: Enabled SECURE_SSL_REDIRECT, HSTS, and secure cookie flags (active only when DEBUG=False).
• Security Headers: Added X-Frame-Options: DENY, Content-Type-Nosniff, and XSS-Filter headers.
• CORS Hardening: Set `CORS_ALLOW_CREDENTIALS = False

API Security & IDOR Fixes

• IDOR Fix: Added ownership verification in conversation_path endpoint. Users can now only access paths between messages they own.
• URL Expiry: Reduced GCS signed URL expiry from 900s to 300s (5 minutes) to minimize the attack window for leaked URLs.
• Header-based Auth: Migrated Google API Key from URL query parameters to the secure x-goog-api-key header.

Rate Limiting & Resource Protection

• Burst Protection (DRF Throttles):
  • AIGenerationThrottle: 30 req/min per user (prevents rapid-fire API cost abuse).
  • AuthRateThrottle: 10 req/min per IP (prevents brute-force on login/register).
• Daily Quotas (Logic from PR rate-limiting-per user and anonymus user blocked #167):
  • 15 messages/day limit for direct and compare modes.
  • Uses select_for_update() to ensure strict enforcement across concurrent requests.
• Access Control: Blocked anonymous users from starting direct or compare mode sessions.

Error Handling & Cleanup

• Error Sanitization: Replaced str(e) with sanitize_error_message(e) across 10+ files to prevent leaking internal traceback details or API keys in response logs.
• Custom Exception Handler: Implemented a global DRF handler to return clean JSON errors for production 500s.
• Cleanup: Removed unused scripts (fix_job_sync.py, trigger_sync.py) and updated .gitignore.

Verification Results

• Zero str(e) instances remain in application code.
• Verified IDOR fix with manual session ID manipulation.
• Verified rate limiting returns 429 Too Many Requests.