fix(api): stop SSR org lookups from hitting the global rate limit

Resolve sessions before rate limiting so keys are per-user, exempt trusted server API key calls and get-session, and raise the GET /organization budget for layout loads.

Co-authored-by: Cursor <cursoragent@cursor.com>

apps/api/src/app.ts

@@ -49,7 +49,6 @@ export const app = new Hono()
 
     return sessionCors(c, next);
   })
-  .use('*', rateLimiter)
   .use('*', async (c, next) => {
     if (isPublicCorsPath(c.req.path)) {
       c.set('user', null);
@@ -88,6 +87,7 @@ export const app = new Hono()
 
     await next();
   })
+  .use('*', rateLimiter)
 
   // Routes
   .get('/', (c) =>