api-gateway auth route has no IP reputation scoring (half-merged)

[0xBernny]

Description

This pull request fully implements the missing IP reputation brute-force threat scoring mechanism across /api/auth/* route topologies. It resolves compilation failures caused by unlinked or undefined protection helpers by introducing Redis-backed state operations.

Key Changes

1. Created ipReputation.ts containing concrete implementations for enforceAuthIpReputation, recordAuthIpFailure, recordAuthIpSuccess, and incrementRefreshRate.
2. Incorporated automatic IP throttling blocks immediately upon hitting the AUTH_IP_THRESHOLD margin.
3. Created an administration route payload at GET /api/admin/auth/ip-score for clean backend auditing of blocked endpoints.

Throttling Demonstration Verification

Assuming a system context running an AUTH_IP_THRESHOLD=5:

• Attempt 1-4: Malformed authentications securely call recordAuthIpFailure(ip), returning a incremental tracking step.
• Attempt 5: The helper hits 5. Subsequence router lookups intercepted by enforceAuthIpReputation(ip) immediately drop execution, logging a 429 Too Many Requests response code and protecting internal authentication loops from further calculations.

Related Issues

• Closes api-gateway auth route has no IP reputation scoring (half-merged) #476

Checklist

• I have read the CONTRIBUTING.md guidelines.
• I have updated the documentation accordingly.
• I have added/updated tests for my changes.
• All CI validations pass.

[drips-wave]

@0xBernny Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits