feat: resolve issues #229, #230, #231, and #232

[zikirullahiabdu31-ops]

Detailed explanation of changes and implementation:

1. IP Whitelist with CIDR Notation Support (Closes Implement IP Whitelist with CIDR Notation Support #229):

• Enhanced ipWhitelist middleware in src/middleware/ipWhitelist.ts with IPv4 and IPv6 CIDR parsing using ipaddr.js.
• Added helper isIpInCidrRange to parse and match IP addresses against single IPs or subnets (e.g., 192.168.1.0/24, 2001:db8::/32).
• Integrated dynamic configuration loading via WHITELISTED_IP_CIDRS environment variable in src/config/env.ts.

2. Rate Limiting Bypass for Whitelisted IP Ranges (Closes Add Rate Limiting Bypass for Whitelisted IP Ranges #230):

• Integrated IP CIDR whitelist checking into rate limiting middleware (src/middleware/rateLimit.ts and src/middleware/rateLimitRedis.ts).
• Added isRateLimitBypassed helper function to bypass rate limiting for whitelisted IPs when RATE_LIMIT_BYPASS_ENABLED is enabled.
• Added rateLimitBypassTotal Prometheus counter metric in src/utils/metrics.ts to monitor and track bypassed requests.

3. Encryption Key Rotation for PII Data (Closes Implement Encryption Key Rotation for PII Data #231):

• Implemented non-blocking key rotation job src/jobs/keyRotationJob.ts to re-encrypt PII data with active key versions in paginated batches without interrupting live operations.
• Leveraged dual-key fallback support in src/utils/encryption.ts ensuring uninterrupted read capabilities during and post key rotation.
• Registered key-rotation job in scheduler src/jobs/scheduler.ts configured via KEY_ROTATION_CRON.

4. Audit Logging for All Configuration Changes (Closes Add Audit Logging for All Configuration Changes #232):

• Created database migration migrations/20260729_create_audit_log.sql creating immutable audit_log table with database trigger preventing UPDATE and DELETE.
• Updated src/middleware/auditInterceptor.ts to intercept admin configuration changes, capturing before and after JSON states along with user identity, resource, action, and client metadata.
• Expanded src/services/auditlogService.ts with logConfigChange, fetchConfigAuditLogs, and regulatory exportAuditLogs (supporting CSV and JSON formats).
• Exposed audit log export route /api/admin/audit-logs/export in src/routes/admin.ts.

Description

Brief description of changes.

Related Issue

Fixes #(issue number)

Type of Change

• Bug fix
• New feature
• Documentation update
• Code refactoring
• Performance improvement

Changes Made

Testing

How did you test these changes?

Checklist

• Code follows project style
• Self-reviewed my code
• Commented complex code
• Updated documentation
• No new warnings
• Added tests (if applicable)

Screenshots (if applicable)

Additional Notes

[drips-wave]

@zikirullahiabdu31-ops Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits