feat(security): add per-endpoint API rate limiting with Redis sliding window

Implement @EndpointRateLimit() decorator and EndpointRateLimitGuard for
granular per-endpoint rate limiting using a Redis sorted-set sliding window.
This prevents brute force attacks on auth endpoints, replay attacks on
payment callbacks, and scraping on search endpoints.

Applied rate limits:
- /auth/login: 5 req/min per IP
- /auth/register: 3 req/min per IP
- /listings POST: 10 req/min per user
- /search: 30 req/min per user
- /payments/callback/*: 100 req/min per IP

Features:
- True sliding window (sorted set) for accurate rate measurement
- Configurable key strategy (IP or authenticated user)
- Admin bypass support (enabled by default)
- Fail-open on Redis errors
- Proper 429 response with Retry-After header
- Rate limit headers (X-RateLimit-Limit/Remaining/Reset)
- 22 unit tests covering all scenarios

Co-Authored-By: Paperclip <noreply@paperclip.ing>

apps/api/src/modules/payments/presentation/controllers/payments.controller.ts

@@ -19,6 +19,7 @@ import {
 import { Throttle } from '@nestjs/throttler';
 import { type PaymentProvider } from '@prisma/client';
 import { type JwtPayload, CurrentUser, Roles, JwtAuthGuard, RolesGuard } from '@modules/auth';
+import { EndpointRateLimit, EndpointRateLimitGuard } from '@modules/shared';
 import { CreatePaymentCommand } from '../../application/commands/create-payment/create-payment.command';
 import { type CreatePaymentResult } from '../../application/commands/create-payment/create-payment.handler';
 import { HandleCallbackCommand } from '../../application/commands/handle-callback/handle-callback.command';
@@ -72,6 +73,8 @@ export class PaymentsController {
   @ApiResponse({ status: 201, description: 'Callback processed successfully' })
   @ApiParam({ name: 'provider', enum: ['vnpay', 'momo', 'zalopay'] })
   @Throttle({ 'payment-callback': { ttl: 60_000, limit: 20 } })
+  @EndpointRateLimit({ limit: 100, windowSeconds: 60, keyStrategy: 'ip', adminBypass: false })
+  @UseGuards(EndpointRateLimitGuard)
   @Post('callback/:provider')
   async handleCallback(
     @Param('provider') provider: string,