[monique-7arch]

Summary

Two authentication/rate-limiting hardening fixes for assigned issues.

1. Fail fast on missing CAPTCHA configuration (#1194)

• src/utils/validate-env.ts: boot-time validation now requires RECAPTCHA_SECRET whenever CAPTCHA is enabled (the default; only CAPTCHA_BYPASS=true disables it). A missing secret aborts boot with a clear fatal message instead of surfacing as an opaque 500 during login.
• src/auth/auth.service.ts: verifyCaptcha now throws a stable ServiceUnavailableException (CAPTCHA_SERVICE_UNAVAILABLE) instead of a bare Error for a missing secret.
• .env.example: documented the new requirement.
• Spec coverage in test/unit/validate-env.spec.ts and src/auth/auth.service.captcha.spec.ts.

2. Trusted reverse-proxy handling for rate-limit client IPs (#1195)

• src/auth/guards/rate-limit.guard.ts: x-forwarded-for is no longer trusted unconditionally. It is only consulted when TRUST_PROXY is configured; entries are sanitised (sanitizeIpEntry) and the derived IP is SHA-256 hashed before use as a rate-limit key, so a spoofed or malformed header can never rotate the per-IP buckets.
• src/main.ts: trust proxy is set from TRUST_PROXY env (NestExpressApplication), off by default.
• Spec coverage in src/auth/rate-limit.guard.spec.ts for spoofing/malformed-header cases.

Closes #1194
Closes #1195
Closes #1196
Closes #1197

[drips-wave]

@monique-7arch Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM