feat: implement security enhancements (task 17)

- Add rate limiting for login, registration, and invitations
- Implement CSRF protection with SameSite cookies and security headers
- Configure secure session cookies with httpOnly and secure flags
- Enhance input sanitization for XSS and injection prevention
- Add comprehensive security tests (41 tests passing)
- Document security enhancements in SECURITY_ENHANCEMENTS.md

Requirements: 9.3, 9.4, 9.5

lib/sharing-actions.ts

@@ -4,6 +4,7 @@ import { prisma } from './db'
 import { revalidatePath } from 'next/cache'
 import { auth } from '@/auth'
 import { z } from 'zod'
+import { checkRateLimit, INVITATION_RATE_LIMIT } from './rate-limit'
 
 // Validation schemas
 const inviteSchema = z.object({
@@ -63,6 +64,15 @@ export async function inviteUserToList(
     
     const userId = session.user.id
     
+    // Rate limiting - Requirement 9.3
+    const rateLimitKey = `invite:${userId}`
+    const rateLimit = checkRateLimit(rateLimitKey, INVITATION_RATE_LIMIT)
+    
+    if (!rateLimit.allowed) {
+      const minutesUntilReset = Math.ceil((rateLimit.retryAfter || 0) / 60000)
+      throw new Error(`Too many invitation attempts. Please try again in ${minutesUntilReset} minutes.`)
+    }
+    
     // Validate input
     if (!listId) {
       throw new Error('List ID is required')