fix(security): Rate limiting is configured but never enforced #39

ThrottlerModule.forRoot is configured (app.module.ts:70) but no global ThrottlerGuard is registered (no APP_GUARD anywhere). Only ApiKeyThrottlerGuard is applied manually to a few controllers, so most endpoints, including auth, are not rate-limited. The config gives a false sense of protection.