fix(security): Rate limiting is configured but never enforced

`ThrottlerModule.forRoot` is configured (app.module.ts:70) but no global `ThrottlerGuard` is registered (no `APP_GUARD` anywhere). Only `ApiKeyThrottlerGuard` is applied manually to a few controllers, so most endpoints, including auth, are not rate-limited. The config gives a false sense of protection.

Start by reading app.module.ts around line 70 and locating the existing ApiKeyThrottlerGuard applications. Trace how guards are registered, then verify that throttling is enforced globally, including on auth routes, and that the configured rate limit is no longer merely declarative.

Written by the indexing model from the issue text.