fix(security): explicit per-route rate limits (CodeQL js/missing-rate-limiting)

All /api/ routes are already covered by the global @fastify/rate-limit
(index.ts:283), but CodeQL doesn't model the global registration and flagged
every route without an explicit per-route limit. Added tuned config.rateLimit
to 45 routes: stricter on auth/credential routes (mfa/saml/oidc/api-keys,
15-30/min), moderate on writes (60/min), generous on reads/polls (300/min =
the global default). Real defense-in-depth on sensitive routes. 3 alerts on
non-route code (a preHandler hook, the rate-limiter's own DB lookup, a test
helper) are documented false-positives covered by the global limiter.

apps/api/src/index.ts

@@ -566,6 +566,7 @@ app.get("/api/v1/readyz", async (_request, reply) => {
 // Cancel a job (authenticated)
 app.post(
   "/api/v1/jobs/:jobId/cancel",
+  { config: { rateLimit: { max: 300, timeWindow: "1 minute" } } },
   async (
     request: import("fastify").FastifyRequest<{ Params: { jobId: string } }>,
     reply: import("fastify").FastifyReply,