Automate dev DB setup with migrations and relax API rate limits in development

Co-authored-by: dennis <dennis@konkol.net>

app/api/projects/route.ts

@@ -1,22 +1,25 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { prisma } from '@/lib/prisma';
 import { apiCache } from '@/lib/cache';
-import { requireSessionAuth, checkRateLimit, getRateLimitHeaders } from '@/lib/auth';
+import { requireSessionAuth, checkRateLimit, getRateLimitHeaders, getClientIp } from '@/lib/auth';
 import { PrismaClientKnownRequestError } from '@prisma/client/runtime/library';
 import { generateUniqueSlug } from '@/lib/slug';
 
 export async function GET(request: NextRequest) {
   try {
     // Rate limiting
-    const ip = request.headers.get('x-forwarded-for') || request.headers.get('x-real-ip') || 'unknown';
-    if (!checkRateLimit(ip, 10, 60000)) { // 10 requests per minute
+    const ip = getClientIp(request);
+    const rlKey = ip !== "unknown" ? ip : `dev_unknown:${request.headers.get("user-agent") || "ua"}`;
+    // In development we keep this very high to avoid breaking local navigation/HMR.
+    const max = process.env.NODE_ENV === "development" ? 300 : 60;
+    if (!checkRateLimit(rlKey, max, 60000)) {
       return new NextResponse(
         JSON.stringify({ error: 'Rate limit exceeded' }), 
         { 
           status: 429, 
           headers: { 
             'Content-Type': 'application/json',
-            ...getRateLimitHeaders(ip, 10, 60000)
+            ...getRateLimitHeaders(rlKey, max, 60000)
           } 
         }
       );