fix(security): harden auth — rate limiting, admin audit logging, JWT aud/iss

- Add @Throttle (5 req/hour per IP) on register, login, refresh endpoints
- Add audit logging in RolesGuard for failed admin access attempts (userId, role, IP, action)
- Add audience ('goodgo-api') and issuer ('goodgo-platform') claims to JWT tokens
- Validate aud/iss in JwtStrategy to prevent cross-service token reuse

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/auth/auth.module.ts

@@ -46,7 +46,7 @@ const QueryHandlers = [GetProfileHandler, GetAgentByUserIdHandler];
         }
         return secret;
       })(),
-      signOptions: { expiresIn: '15m' },
+      signOptions: { expiresIn: '15m', audience: 'goodgo-api', issuer: 'goodgo-platform' },
     }),
   ],
   controllers: [AuthController],