Added Arcjet security (Shield, rate limit, bot detection)

[davidmytton]

Adds Arcjet route protections:

• Shield, for general protection against common attacks and suspicious behavior.
• Rate limiting, to help manage costs, keyed off the Clerk userId
• Bot protection, to prevent automated clients from calling the API routes.