[demilade18-git]

Summary

Two fixes for assigned issues.

1. Environment-driven login lockout config (#1190)

• src/auth/login-rate-limit.service.ts: maxAttempts and lockoutDurationMinutes are now read from ConfigService via LOGIN_MAX_ATTEMPTS and LOGIN_LOCKOUT_MINUTES (positive-integer validated, defaults 5/30 preserved). Invalid or missing values fall back to safe defaults with a logged warning.
• .env.example and docs/LOGIN_RATE_LIMITING.md: documented the new variables and removed the "future enhancement" note.
• Spec coverage in src/auth/login-rate-limit.service.spec.ts for custom thresholds, lockout window, and invalid-value fallback.

2. API-key header mismatch (#1193)

• src/auth/guards/api-key-auth.guard.ts: accepts all three transports identically — api-key (documented), legacy x-api-key, and Authorization: ApiKey <key> — with a deterministic 401 when none is present.
• src/config/swagger.config.ts: documents both header names.
• src/main.ts: CORS allowedHeaders now includes x-api-key.
• Spec coverage in src/auth/guards/api-key-auth.guard.spec.ts.

Closes #1190
Closes #1191
Closes #1192
Closes #1193

[drips-wave]

@demilade18-git Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM