fix: enforce strict boundary limits on grace and opacity inputs (JhaSourav07#3421)

## Description
Implements robust runtime boundary validation and value clamping using
`Math.max` and `Math.min` for both the `grace` (0-7) and `opacity`
(0.1-1.0) URL query parameters inside the primary streak API route
(`app/api/streak/route.ts`). This safely normalizes unexpected or
extreme inputs before they are passed down to the SVG geometry renderer.

## Related Issue
Closes JhaSourav07#3413

## Type of Change
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to not work as expected)
- [ ] This change requires a documentation update

## Checklist
- [x] My code follows the style guidelines of this project
- [x] I have performed a self-review of my own code
- [x] I have commented my code, particularly in hard-to-understand areas
- [x] My changes generate no new warnings

Author: JhaSourav07

app/api/streak/route.ts

@@ -197,7 +197,12 @@ export async function GET(request: Request) {
       width,
       height,
       size,
-      grace,
+
+      grace: Math.max(
+        0,
+        Math.min(7, typeof grace === 'number' ? grace : parseInt(String(grace || 1), 10))
+      ),
+
       mode,
       repo,
       org,
@@ -208,7 +213,12 @@ export async function GET(request: Request) {
       gradient,
       gradient_stops,
       gradient_dir,
-      opacity,
+
+      opacity: Math.max(
+        0.1,
+        Math.min(1.0, typeof opacity === 'number' ? opacity : parseFloat(String(opacity || 1.0)))
+      ),
+
       disable_particles,
       glow,
       animate,