feat(auth): overhaul SEP-10 JWT generation and rate limiting

[enny791]

Summary

The current SEP-10 authentication flow is experiencing bottlenecks under high concurrency, and the JWT generation logic is fragmented across multiple services. As a financial platform handling sensitive operations, we must ensure that our authentication layer is both highly performant and strictly secure. Our DevOps telemetry indicates that unbounded auth requests could leave us vulnerable to brute-force attacks on the challenge endpoint.

This overhaul requires implementing a Redis-backed sliding window rate limiter specifically scoped to the /auth routes. Furthermore, the JWT generation must be centralized into a dedicated cryptographic utility class, enforcing the RS256 signing algorithm across the board. The expected outcome is a resilient auth layer capable of handling 500+ TPS with zero dropped connections.

Acceptance Criteria

• Extract all JWT signing logic to AuthUtil.ts.
• Implement Redis-backed rate limiting (100 req/min) on /auth/challenge.
• Write integration tests verifying 429 Too Many Requests responses.
• Ensure backward compatibility with existing valid tokens.

Tech Stack

TypeScript (Node.js 24), Express, ioredis, jsonwebtoken. Must comply with OWASP top 10 guidelines.