fix: Implement API security headers and UX-friendly rate limiting

[PiyushSonkusare]

What does this PR do?
This PR introduces baseline API security and spam protection for the backend server by implementing helmet and express-rate-limit.

Specific Changes:

• HTTP Header Security: Added helmet to automatically secure the Express app by setting standard, recommended HTTP headers.

• Targeted Rate Limiting: Applied express-rate-limit specifically to /api routes. The threshold is intentionally set to a generous 500 requests per 15-minute window. This effectively blocks malicious scripts or continuous spam while giving legitimate users plenty of breathing room.

• Graceful Error Handling: Configured the rate limiter to return a formatted JSON response (429 Too Many Requests) rather than a plain text string. This ensures the frontend can easily parse the error and display a user-friendly message if the limit is ever reached (e.g., during rapid page refreshing).

Why is this needed?

• To protect the server architecture from automated bot spam or brute-force attacks, while ensuring that normal users maintain a seamless experience.

How to test:

1. Start the local server.
2. Rapidly hit an /api endpoint (simulating >500 requests).
3. Verify that the server returns a 429 status code with the custom JSON error message.
4. Verify that static assets and non-API routes remain unaffected and unblocked.