fix(api): validate GitHub usernames before downstream API requests (JhaSourav07#1852)

## Description

Fixes JhaSourav07#1782

This PR fixes an issue where the `/api/github` endpoint accepted
malformed GitHub usernames and allowed them to reach the GitHub API
layer, resulting in downstream fetch errors instead of validation
failures.

### Changes Made

* Added GitHub username validation to `githubParamsSchema`
* Rejects usernames containing invalid characters
* Rejects whitespace-only usernames
* Rejects usernames exceeding GitHub's maximum length limit
* Added regression tests covering all of the above scenarios

### Validation

Verified that invalid usernames now return a `400 Bad Request` response
during request validation rather than triggering downstream GitHub API
errors.

## Pillar

* [ ] 🎨 Pillar 1 — New Theme Design
* [ ] 📐 Pillar 2 — Geometric SVG Improvement
* [ ] 🕐 Pillar 3 — Timezone Logic Optimization
* [x] 🛠️ Other (Bug fix, refactoring, docs)

## Visual Preview

N/A (API validation bug fix)

## Checklist before requesting a review:

* [x] I have read the `CONTRIBUTING.md` file.
* [x] I have tested these changes locally
(`localhost:3000/api/github?username=octocat` and invalid username
cases).
* [x] I have run `npm run lint` locally and resolved all errors related
to my changes.
* [x] My commits follow the Conventional Commits format (e.g.,
`feat(themes): ...`, `fix(calculate): ...`).
* [ ] I have updated `README.md` if I added a new theme or URL
parameter.
* [x] I have starred the repo.
* [x] I have made sure that I have only one commit to merge in this PR.
* [ ] The SVG output matches the CommitPulse "premium quality" aesthetic
standard (not applicable).
* [x] (Recommended) I joined the CommitPulse Discord community for
contributor discussions, mentorship, and faster PR support.

Author: JhaSourav07

app/api/github/route.test.ts

@@ -30,8 +30,37 @@ describe('GET /api/github', () => {
 
     it('calls getFullDashboardData with { bypassCache: false } when refresh is omitted', async () => {
       await GET(makeRequest({ username: 'octocat' }));
+      expect(getFullDashboardData).toHaveBeenCalledWith('octocat', {
+        bypassCache: false,
+      });
+    });
+    it('returns 400 when username contains invalid characters', async () => {
+      const response = await GET(makeRequest({ username: '@@@@@' }));
+      const body = await response.json();
 
-      expect(getFullDashboardData).toHaveBeenCalledWith('octocat', { bypassCache: false });
+      expect(response.status).toBe(400);
+      expect(body.error).toContain('Invalid parameters');
+    });
+
+    it('returns 400 when username contains only whitespace', async () => {
+      const response = await GET(makeRequest({ username: '   ' }));
+      const body = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(body.error).toContain('Invalid parameters');
+    });
+
+    it('returns 400 when username exceeds GitHub maximum length', async () => {
+      const response = await GET(
+        makeRequest({
+          username: 'aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa',
+        })
+      );
+
+      const body = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(body.error).toContain('Invalid parameters');
     });
 
     // Test 1 — missing username → 400

lib/validations.ts

@@ -245,6 +245,7 @@ export const streakParamsSchema = z.object({
 export const githubParamsSchema = z.object({
   username: z
     .string({ error: 'Missing "username" parameter' })
+    .trim()
     .min(1, { message: 'Username is required' })
     .max(39, { message: 'GitHub username cannot exceed 39 characters' })
     .regex(GITHUB_USERNAME_REGEX, {