[STORY 3.2] Multi-Turn Session Management & Abuse Prevention

[RamonRiosJr]

📝 Description

Provide memory capabilities to the AI bot while establishing hard rate limits. This prevents API abuse and guarantees budget predictability.

🎯 Acceptance Criteria

• Setup Upstash Redis for stateless short-term memory (TTL 30 minutes)
• Implement IP and Session based Token Bucket rate-limiting (e.g. 20 messages / hr / IP)
• Scrub aggressive or unsanitized input via regex checks before proxying to LLM provider
• Graceful UI degradation returning 429 Too Many Requests to client with helpful message