FAC-85 feat: API rate limiting

[y4nder]

Summary

• Implement @nestjs/throttler v6 with Redis-backed storage (@nest-lab/throttler-storage-redis) for per-IP request rate limiting
• Global default of 60 req/60s, stricter limits on auth login (5/60s), auth refresh (10/60s), and Moodle login (5/60s)
• Custom ThrottlerGuard subclass with fail-open resilience — allows requests through with a warning log if Redis is unavailable
• Health endpoint exempt from throttling via @SkipThrottle()
• Env-configurable global defaults (THROTTLE_TTL_SECONDS, THROTTLE_LIMIT) with Zod validation (integer, min 1)

Closes #88

Test plan

• 4 unit tests for CustomThrottlerGuard (extends base, 429 passthrough, fail-open on Redis error, fail-open on non-Error throws)
• 3 e2e tests (global limit exceeded returns 429, per-route stricter limit, health endpoint exempt)
• All 561 existing unit tests pass — zero regressions
• Lint clean
• Manual verification: npm run start:dev + docker compose up, rapid-fire curl requests, verify 429 responses and Retry-After header
• Manual verification: stop Redis container, verify API continues serving requests (fail-open)