Swagger docs describe auth/rate-limit behavior that some controllers don't actually implement

[meshackyaro]

Description

The Swagger DocumentBuilder description in main.ts (src/main.ts) states 'All endpoints use a Redis-backed distributed token bucket with coordinated per-IP and per-wallet limits' and that wallet-signature auth 'blocks replay attacks across all API nodes' — both true of the underlying RateLimitGuard/NonceStoreService mechanisms in isolation, but the wording reads as a blanket guarantee. In practice, several endpoints covered elsewhere in this batch don't require authentication at all (EscrowController's state-changing routes, WebhookController's register/unregister), so the 'per-wallet' portion of the rate-limit guarantee doesn't apply to them (they only get IP-scoped limiting, and even that is spoofable per the wallet-identity-spoofing issue in this batch). A reader of the public API docs would reasonably assume stronger guarantees than the code currently provides.

Component

Backend

Difficulty

🟢 Easy

Tasks

• Audit the global Swagger description in main.ts against actual per-controller guard usage and correct any overstated claims
• Consider adding a short per-tag note (via .addTag(...)) on any module where authentication is currently inconsistent, until the related auth-gap issues in this batch are resolved
• Re-review this doc text as a checklist item when closing the related auth-gap issues so it stays accurate

Acceptance Criteria

• The Swagger description in main.ts accurately reflects which endpoints are actually authenticated/rate-limited by wallet vs. IP only

Estimated Time

2-3 hours