Add docs navigation and tighten API request security

lib/request-security.ts

@@ -0,0 +1,23 @@
+import { ServiceError } from "./service-error";
+
+/** Device upload tokens cannot authorize staff actions or issue other credentials. */
+export async function browserAccount<T extends { id: string }>(
+  request: Pick<Request, "headers">,
+  getUser: () => Promise<T | null>,
+): Promise<T> {
+  if (request.headers.has("authorization"))
+    throw new ServiceError("Use your signed-in account for this action", 403);
+  const account = await getUser();
+  if (!account) throw new ServiceError("Sign in to continue", 401);
+  return account;
+}
+
+export async function limitRoomCreation(
+  accountId: string,
+  accessHash: string,
+  limit: (key: string, count: number, seconds: number) => Promise<void>,
+) {
+  // A browser cookie is replaceable. The verified account is the durable limit.
+  await limit("multiplayer:create:account:" + accountId, 20, 3600);
+  await limit("multiplayer:create:" + accessHash, 20, 3600);
+}