fix(rate-limit): share counters via Redis store and drop spoofable client IPs

[naobadiah01]

Summary

Closes #12. Rate limiting was a per-process Map keyed by a client-supplied
header — counters reset on every restart, were per-replica, and the identity
could be rotated by sending a different x-forwarded-for per request.

Changes

• Shared atomic store (src/middleware/rate-limit-store.ts): new
  RateLimitStore interface with an atomic increment(key, windowMs)
  returning { count, resetTime }. A RedisStore implements it with a Lua
  script (INCR + PEXPIRE, fixed-window), and InMemoryStore remains as
  the fallback for development and tests.
• One store for all limiters: generalLimiter, authLimiter,
  employerLimiter, and authenticatedLimiter all share the single store
  singleton, so limits are combined across replicas and survive restarts
  when REDIS_URL is configured.
• Non-spoofable identity: getClientIP uses the socket address unless
  TRUST_PROXY=true is set; only then is the rightmost x-forwarded-for
  hop trusted. Clients can no longer rotate headers to reset their budget.
• Fail-open: if the store is unreachable the request proceeds rather
  than blocking valid traffic.
• Docs/env: REDIS_URL and TRUST_PROXY added to .env.example,
  docs/ARCHITECTURE.md, and docs/OPERATIONS.md.

Acceptance criteria

• Single shared store backs all four limiters; counters survive restart
• Two processes sharing the store enforce a combined limit
• Trusted-proxy mode keys on the rightmost trusted hop
• Without a trusted proxy, client-supplied x-forwarded-for cannot rotate the key
• Unit tests cover fixed-window reset, 429 + headers, and identity behavior
• In-memory store retained as test fallback
• Docs and .env.example document the Redis requirement and proxy setting

Tests

pnpm lint, pnpm test:coverage (rate-limit suite: 11 tests pass).