feat(auth): rate-limit POST /auth/exchange-token

Add @Throttle and @EndpointRateLimit decorators to the exchangeToken
endpoint matching other auth endpoints (20/hour per throttler, 5/60s
per IP via EndpointRateLimitGuard). Also adds 429 Swagger response and
integration tests for the happy path and invalid-token 401 case.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/auth/presentation/controllers/auth.controller.ts

@@ -230,10 +230,14 @@ export class AuthController {
     );
   }
 
+  @Throttle({ default: { ttl: 3_600_000, limit: AUTH_RATE_LIMIT }, auth: { ttl: 3_600_000, limit: 20 } })
+  @EndpointRateLimit({ limit: IS_TEST ? 10_000 : 5, windowSeconds: 60, keyStrategy: 'ip' })
+  @UseGuards(EndpointRateLimitGuard)
   @Post('exchange-token')
   @ApiOperation({ summary: 'Exchange OAuth token pair for httpOnly cookies' })
   @ApiResponse({ status: 201, description: 'Auth cookies set' })
   @ApiResponse({ status: 401, description: 'Invalid access token' })
+  @ApiResponse({ status: 429, description: 'Too many requests' })
   async exchangeToken(
     @Body() body: { accessToken: string; refreshToken: string; expiresIn?: number },
     @Res({ passthrough: true }) res: Response,