fix: rate limiting, filter/sort allowlists, overflow bounds, and bench CI gates

[DanielCharis1]

Summary

Resolves the four Stellar Wave issues assigned to @DanielCharis1: rate limiting for auth/wallet flows (#295), filtering & sorting allowlists (#277), overflow/boundary behavior for onchain arithmetic (#265), and resource-budget regression thresholds in contract CI (#281).

Changes

#295 — Rate limiting for authentication & wallet verification

• RateLimiterModule is now @Global and registered in AppModule, so the guard/decorator work anywhere.
• RateLimitGuard emits standard retry metadata on 429: Retry-After + X-RateLimit-* headers and retryAfterSeconds in the error body.
• Supports account/wallet-aware keys via an optional keyGenerator (login keys by email, wallet verification keys by address) while still throttling anonymous traffic by IP.
• Applied to POST /auth/register, POST /auth/login, POST /auth/validate-token, POST /wallet/link, and POST/GET /wallet/verify-signature.
• New unit tests for lockout, window reset, per-key isolation, retry-after, and header emission (16 tests).

#277 — Filtering & sorting allowlists

• puzzle-reviews previously interpolated raw sortBy/sortOrder query strings into the SQL ORDER BY (queryBuilder.orderBy(\review.${sortBy}`)). Runtime allowlists now map public keys (createdAt/rating/helpfulCount, ASC/DESC`) to known columns and reject anything else with a 400, enforced in both the controller and the service.
• New service tests cover allowlist enforcement (5 tests).

#265 — Overflow & boundary behavior (onchain)

• All counter arithmetic in the game contract now uses checked arithmetic (question_id, per-level indices, attempts, last_question_index, and the old-level index decrement) and fails with a defined Error::ArithmeticOverflow (Replace hardcoded JWT secret fallback "your-secret-key" with a startup-time assert #12) instead of wrapping.
• Added min/max and overflow boundary tests (question-count overflow, per-level limit boundary, attempts overflow, last-question-index overflow).

#281 — Resource-budget regression thresholds in contract CI

• Root cause: bench.rs/test.rs were never declared as modules in lib.rs, so the CI bench step ran zero tests and uploaded empty output. They are now wired in (#[cfg(test)] mod test; mod bench;).
• Fixed the duplicated nested bench test and the AttemptTooSoon ledger issue in the bench loop.
• New onchain/bench-baselines.json documents the budget baselines; scripts/check-bench-budgets.py parses the bench output and fails the job on any metric exceeding its baseline (or when no measurements appear at all). Wired into build.yml after the bench step.

Additional fixes required to make cargo test --workspace --locked green

• onchain/Cargo.lock was stale (missing the receiver's dev-deps) and broke all --locked builds; regenerated.
• Fixed the un-wired stellar_hunts test suite for the soroban-sdk 22 APIs (register_contract returns Address, MockAuth borrow semantics) and the broken stellar_hunts_nft test_double_mint_rejected that referenced undefined bindings.
• Ran cargo fmt across the onchain workspace so the fmt gate passes.

Testing

• Onchain: cargo test --workspace --locked — all 27 tests pass (23 game contract + 4 NFT); bench measurements (CPU 185k / mem 29k / avg 17k) are well under the documented baselines and check-bench-budgets.py exits 0.
• Backend: jest on the touched areas — 25 tests pass (rate-limiter service + guard, wallet, puzzle-review allowlists). Backend tsc shows no new errors in changed files (pre-existing repo errors remain, matching the advisory CI note).
• cargo fmt --all -- --check passes.

Related Issues

Closes #295, closes #281, closes #277, closes #265

[drips-wave]

@DanielCharis1 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits