Throtter

[Nanafancy]

[BE-29] Add global ThrottlerGuard for rate limiting in opsce module

Problem
@nestjs/throttler is installed but not configured. All endpoints are open to brute-force attacks. The login endpoint is especially vulnerable to credential stuffing.

Proposed Solution
Configure ThrottlerModule.forRootAsync() in OpsceModule. Apply stricter per-route limits on /api/auth/login and /api/auth/forgot-password.

Acceptance Criteria
Global limit: 100 requests per 60 seconds per IP
POST /api/auth/login limited to 5 requests per 60 seconds per IP using @Throttle()
POST /api/auth/forgot-password limited to 3 requests per 60 seconds per IP
Returns 429 Too Many Requests with Retry-After header when limit is exceeded
TTL and limit values configurable via THROTTLE_TTL and THROTTLE_LIMIT env variables
Guard registered globally via APP_GUARD in OpsceModule
closes #754

[vercel]

@Nanafancy is attempting to deploy a commit to the naijabuz's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Nanafancy Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits