feat: add rate limiting and startup options validation

Tiku.Api/Options/OptionsValidation.cs

@@ -0,0 +1,21 @@
+namespace Tiku.Api.Options;
+
+public static class OptionsValidation
+{
+    public static bool BeValidCorsOptions(CorsOptions options)
+    {
+        if (options.AllowCredentials && options.AllowedOrigins.Length == 0)
+        {
+            return false;
+        }
+
+        return options.AllowedOrigins.All(IsHttpOrigin);
+    }
+
+    private static bool IsHttpOrigin(string origin)
+    {
+        return Uri.TryCreate(origin, UriKind.Absolute, out var uri) &&
+               (uri.Scheme == Uri.UriSchemeHttp || uri.Scheme == Uri.UriSchemeHttps) &&
+               string.IsNullOrEmpty(uri.PathAndQuery.Trim('/'));
+    }
+}