Add Vercel BotID protection

Summary

• Adds Vercel BotID Edge Middleware to gate /api/generate — bots are blocked with 403 before reaching the Flask function
• Adds vercel.json with BotID proxy rewrites for client-side challenge scripts
• Adds botid Node.js dependency for the middleware runtime

Note

Any frontend consuming this API needs to load the BotID client-side challenge (initBotId() from botid/client/core) targeting { path: '/api/generate', method: 'GET' } — without it, requests will be classified as bots.

Post-merge

• Enable BotID Deep Analysis in the Vercel dashboard Firewall tab if desired