chore: Add tests for auth cookie extraction and rate limit middleware behavior

- Implemented tests for `extractAuthCookieToken` to ensure it returns an empty string when the request is nil and ignores non-auth cookies.
- Added tests for `isAdminSecurityControlPlaneRequest` to verify it correctly uses the decoded raw path.
- Enhanced `NewRateLimitMiddleware` tests to check fallback behavior for non-positive window values and to ensure it bypasses rate limiting for control plane bearer requests.

backend/internal/api/middleware/auth_test.go

@@ -403,3 +403,27 @@ func TestAuthMiddleware_RejectsTokenAfterSessionInvalidation(t *testing.T) {
 
 	assert.Equal(t, http.StatusUnauthorized, w.Code)
 }
+
+func TestExtractAuthCookieToken_ReturnsEmptyWhenRequestNil(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	recorder := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(recorder)
+	ctx.Request = nil
+
+	token := extractAuthCookieToken(ctx)
+	assert.Equal(t, "", token)
+}
+
+func TestExtractAuthCookieToken_IgnoresNonAuthCookies(t *testing.T) {
+	gin.SetMode(gin.TestMode)
+	recorder := httptest.NewRecorder()
+	ctx, _ := gin.CreateTestContext(recorder)
+
+	req, err := http.NewRequest("GET", "/", http.NoBody)
+	require.NoError(t, err)
+	req.AddCookie(&http.Cookie{Name: "session", Value: "abc"})
+	ctx.Request = req
+
+	token := extractAuthCookieToken(ctx)
+	assert.Equal(t, "", token)
+}