fix(security): enforce authentication on rate limits, deny unconfigured admin access, and sanitize git fetcher args

[tarun1790]

Summary of Changes

This Pull Request resolves critical authentication bypasses and SSRF argument injection vulnerabilities across MemoryProxy and MemoryKnowledge:

1. Enforce Authentication on Admin Rate Limit Endpoints (MemoryProxy/src/routes/rate-limits.ts):

   • Wrapped get, put, and delete handlers in createRateLimitHandlers with checkAdminAuth() validation to prevent unauthenticated query, override, or deletion of tenant rate limits.

2. Deny Access on Unconfigured Admin Key (MemoryProxy/src/routes/admin-auth.ts):

   • Updated checkAdminAuth() to return "missing" instead of "ok" when config.admin.apiKey is empty/unconfigured, protecting operational administrative routes (such as /v3/instance/proxy-destroy) from unauthenticated exposure.

3. Sanitize Input Parameters in Git Source Fetcher (MemoryKnowledge/src/source-fetcher/git-fetcher.ts):

   • Added validation against whitespace and trailing CLI option flags (-c, --) in sourceUrl before invoking simpleGit().clone() to prevent argument injection attacks.

Verification

• Verified routes and type correctness across MemoryProxy and MemoryKnowledge.

[Maxwell-Code07]

Thank you for your interest and contributions! We will review your code and get back to you as soon as possible!