chores: add rate_limiting

[KodeSage]

Description

CLOSE #9

Adds per-IP rate limiting to the unauthenticated auth endpoints to prevent abuse — both endpoints were previously unprotected and could be spammed indefinitely, generating nonces and burning CPU on Stellar signature verification.

Uses express-rate-limit with per-route middleware (not router-level), so authenticated routes are unaffected:

• POST /auth/challenge — 10 requests / minute / IP
• POST /auth/verify — 5 requests / minute / IP (lower because it runs SHA-256 + Stellar Ed25519 verification + a DB upsert)

Exceeding either limit returns 429 Too Many Requests with a Retry-After header (via standardHeaders: 'draft-7').

Files changed

• apps/backend/src/routes/auth.ts — defined challengeLimiter and verifyLimiter, wired each in front of its respective route's validate(...) middleware.
• apps/backend/src/__tests__/auth.integration.test.ts — added resetRateLimiters() helper into existing beforeEachs (so the new middleware doesn't bleed across the existing 10 tests), plus a new describe('Auth rate limiting') block with 5 tests.
• apps/backend/package.json — added express-rate-limit@^8.5.2.

Acceptance criteria

• Exceeding the limit returns 429.
• Legitimate requests within the limit pass through.
• Rate limiter does not affect authenticated routes.
• Retry-After header is present on 429 responses.

Follow-ups (not in this PR)

• Swap the in-process MemoryStore for a Redis-backed store (e.g. rate-limit-redis) using the existing client in apps/backend/src/lib/redis.ts when the backend is scaled horizontally.
• If the service is placed behind a reverse proxy / load balancer, call app.set('trust proxy', ...) so req.ip is the real client IP.

Type of change

• Bug fix
• New feature
• Documentation update
• Other

Checklist

• I have read the contributing guidelines
• I have tested my changes locally
• My code follows the project's coding standards

Test run:

cd apps/backend
pnpm exec vitest run src/__tests__/auth.integration.test.ts
# Test Files  1 passed (1)
# Tests       15 passed (15)

New test cases:

• 10 /auth/challenge requests succeed; 11th returns 429 with Retry-After.
• 5 /auth/verify requests succeed; 6th returns 429 with Retry-After.
• Limiters are independent — exhausting /auth/verify does not block /auth/challenge.
• /me (authenticated) is unaffected — 20 consecutive requests never return 429.
• /health is unaffected — 20 consecutive requests never return 429.

Note: src/__tests__/conversations.cache.test.ts has 3 failing tests on main that are unrelated to this change.

[drips-wave]

@KodeSage Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits