GHSA-rgj7-vg8v-j4wr: Ech0's Unauthenticated Like Endpoint Enables Arbitrary Engagement Metric Inflation

No authentication is required to invoke PUT /api/echo/like/:id. The handler is registered on the public router group. The service increments fav_count for the given echo without checking identity, without a per-user limit, and without CSRF tokens. A remote client can arbitrarily inflate like metrics with repeated requests.