Fix bounded rate-limit guard and validation

[Kingsilva36]

Closes #1680

PR Title

Fix bounded rate-limit guard and validation for admin / operational surfaces

Summary

This change hardens the API’s resource and rate-limit boundary by enforcing bounded values before expensive throttling work runs. It prevents malformed or adversarial configuration from creating unbounded quotas or excessive window sizes, while preserving normal behavior for valid traffic.

What changed

• Added strict clamp bounds for:
  • rate-limit windows
  • read/write limits
  • auth multiplier
  • abuse threshold
  • abuse window
  • abuse factor
• Updated config validation to reject out-of-range env values instead of allowing unsafe extremes.
• Ensured the custom throttler guard normalizes route-level overrides before passing them into the limiter.
• Improved the 429 response to provide a clear retry message:
  • “Rate limit exceeded for X requests. Retry after Ys.”
• Added regression tests covering:
  • oversized limit/window inputs
  • concurrent throttling under real service behavior
  • exhausted quota retry headers and denial paths
  • no-op behavior when rate limiting is disabled

Why this matters

This closes a production-grade gap in operational safety: unbounded or malformed rate-limit inputs can otherwise defeat the guardrail, degrade service quality, or allow repeated work to exhaust resources. The fix ensures deterministic, reviewable behavior under normal, invalid, repeated, and burst traffic conditions.

Scope

This is intentionally narrow and focused on the rate-limit / resource boundary. It does not include unrelated refactors or broad dependency changes.

Validation

I validated the affected rate-limit and guard behavior with:

cd "c:\Users\USER\Desktop\Remitwise-Frontend\meridian-api"
node .\node_modules\jest\bin\jest.js --runInBand --ci --verbose src/rate-limit/rate-limit.service.spec.ts src/common/guards/custom-throttler.guard.spec.ts

Result:

• 2 test suites passed
• 10 tests passed
• exit code 0

I also ran a repo TypeScript check:

cd "c:\Users\USER\Desktop\Remitwise-Frontend\meridian-api"
node .\node_modules\typescript\bin\tsc -p tsconfig.json --noEmit

That still fails due to pre-existing unrelated TypeScript errors in:

• auth.module.ts
• token.provider.spec.ts

Those issues are outside the scope of this fix.

Compatibility

This is backward-compatible for valid settings. The only behavior change is that invalid or excessive rate-limit values are now safely clamped instead of being permitted to create unsafe or unbounded limits.

Notes

This patch preserves the public behavior for normal traffic while providing clear, deterministic failure behavior under invalid or adversarial conditions.

---

Shorter GitHub-ready version

Title:
Fix bounded rate-limit guard and validation

Body:
This PR hardens the API’s resource and rate-limit boundary by clamping invalid or oversized config and route-level inputs before they reach the throttling logic.

Changes

• Added deterministic bounds for rate-limit windows and quota values
• Validated env configuration to reject unsafe values
• Normalized route-level throttler overrides before enforcement
• Improved the 429 response with actionable retry messaging
• Added regression tests covering invalid values, burst traffic, and exhausted quotas

Why

Unbounded rate-limit configuration can allow malformed or adversarial input to bypass protection or exhaust backend resources. This fix ensures predictable, safe behavior under normal, invalid, and burst conditions.

Validation

Passed:

• node .\node_modules\jest\bin\jest.js --runInBand --ci --verbose src/rate-limit/rate-limit.service.spec.ts src/common/guards/custom-throttler.guard.spec.ts

Result:

• 2 suites passed
• 10 tests passed

Known unrelated blocker:

• repo-wide TypeScript compile still fails due to existing errors in the auth module and token provider spec, outside this fix’s scope.