fix(security): add rate limiting to /api/extract to prevent API key exhaustion

[Vedhant26]

🔒 Fix: Add Rate Limiting to AI Extraction Endpoint

Closes #927

Security Issue

The /api/extract endpoint (which connects to the Gemini AI API) was completely unauthenticated and had no rate limiting. This meant a malicious user could spam the endpoint, causing the server to exhaust the GEMINI_API_KEY quota or rack up billing charges, leading to a Denial of Service (DoS) for legitimate users.

Solution

• Installed express-rate-limit.
• Added an extractLimiter middleware explicitly applied to app.post('/api/extract', ...).
• Limited requests to 20 per IP per 15 minutes to allow legitimate usage while strictly blocking automated spam attacks.