security: validate auth input types and limit length to prevent DoS [#1]

Added type checking and length validation to the `slug` and `password` variables in the `app/api/auth/route.ts` file to prevent potential DoS attacks via excessively long strings passed to expensive crypto functions.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

app/api/auth/route.ts

@@ -27,6 +27,16 @@ export async function POST(request: NextRequest) {
       return NextResponse.json({ error: 'Missing slug or password' }, { status: 400 });
     }
 
+    // 🛡️ SECURITY: Validate input types and limit length to prevent DoS attacks
+    // (e.g. from extremely long strings being passed to expensive crypto functions)
+    if (typeof slug !== 'string' || slug.length > 100) {
+      return NextResponse.json({ error: 'Invalid slug format or length' }, { status: 400 });
+    }
+
+    if (typeof password !== 'string' || password.length > 100) {
+      return NextResponse.json({ error: 'Invalid password format or length' }, { status: 400 });
+    }
+
     if (!isProtected(slug)) {
       return NextResponse.json({ error: 'Album is not password-protected' }, { status: 400 });
     }