fix(security): explicit per-route rate limits (CodeQL js/missing-rate-limiting)

All /api/ routes are already covered by the global @fastify/rate-limit
(index.ts:283), but CodeQL doesn't model the global registration and flagged
every route without an explicit per-route limit. Added tuned config.rateLimit
to 45 routes: stricter on auth/credential routes (mfa/saml/oidc/api-keys,
15-30/min), moderate on writes (60/min), generous on reads/polls (300/min =
the global default). Real defense-in-depth on sensitive routes. 3 alerts on
non-route code (a preHandler hook, the rate-limiter's own DB lookup, a test
helper) are documented false-positives covered by the global limiter.

apps/api/src/plugins/auth.ts

@@ -547,72 +547,78 @@ export async function authRoutes(app: FastifyInstance): Promise<void> {
   });
 
   // POST /api/auth/change-password
-  app.post("/api/auth/change-password", async (request: FastifyRequest, reply: FastifyReply) => {
-    const authUser = requireAuth(request, reply);
-    if (!authUser) return;
+  app.post(
+    "/api/auth/change-password",
+    { config: { rateLimit: { max: 30, timeWindow: "1 minute" } } },
+    async (request: FastifyRequest, reply: FastifyReply) => {
+      const authUser = requireAuth(request, reply);
+      if (!authUser) return;
 
-    const parsed = changePasswordSchema.safeParse(request.body);
-    if (!parsed.success) {
-      return reply.status(400).send({
-        error: "Current password and new password are required",
-        code: "VALIDATION_ERROR",
-      });
-    }
-    const body = parsed.data;
+      const parsed = changePasswordSchema.safeParse(request.body);
+      if (!parsed.success) {
+        return reply.status(400).send({
+          error: "Current password and new password are required",
+          code: "VALIDATION_ERROR",
+        });
+      }
+      const body = parsed.data;
 
-    const pwError = await validatePasswordStrength(body.newPassword);
-    if (pwError) {
-      return reply.status(400).send({
-        error: pwError,
-        code: "VALIDATION_ERROR",
-      });
-    }
+      const pwError = await validatePasswordStrength(body.newPassword);
+      if (pwError) {
+        return reply.status(400).send({
+          error: pwError,
+          code: "VALIDATION_ERROR",
+        });
+      }
 
-    const [user] = await db.select().from(schema.users).where(eq(schema.users.id, authUser.id));
+      const [user] = await db.select().from(schema.users).where(eq(schema.users.id, authUser.id));
 
-    if (!user) {
-      return reply.status(404).send({ error: "User not found", code: "NOT_FOUND" });
-    }
+      if (!user) {
+        return reply.status(404).send({ error: "User not found", code: "NOT_FOUND" });
+      }
 
-    if (!user.passwordHash) {
-      return reply.status(400).send({
-        error: "Password changes are managed by your identity provider.",
-        code: "OIDC_NO_PASSWORD",
-      });
-    }
+      if (!user.passwordHash) {
+        return reply.status(400).send({
+          error: "Password changes are managed by your identity provider.",
+          code: "OIDC_NO_PASSWORD",
+        });
+      }
 
-    const valid = await verifyPassword(body.currentPassword, user.passwordHash);
-    if (!valid) {
-      return reply
-        .status(401)
-        .send({ error: "Current password is incorrect", code: "INVALID_PASSWORD" });
-    }
+      const valid = await verifyPassword(body.currentPassword, user.passwordHash);
+      if (!valid) {
+        return reply
+          .status(401)
+          .send({ error: "Current password is incorrect", code: "INVALID_PASSWORD" });
+      }
 
-    const newHash = await hashPassword(body.newPassword);
+      const newHash = await hashPassword(body.newPassword);
 
-    await db
-      .update(schema.users)
-      .set({ passwordHash: newHash, mustChangePassword: false, updatedAt: new Date() })
-      .where(eq(schema.users.id, authUser.id));
-
-    // Invalidate all other sessions for this user
-    const currentToken = extractToken(request);
-    if (currentToken) {
       await db
-        .delete(schema.sessions)
-        .where(and(eq(schema.sessions.userId, authUser.id), ne(schema.sessions.id, currentToken)));
-    }
+        .update(schema.users)
+        .set({ passwordHash: newHash, mustChangePassword: false, updatedAt: new Date() })
+        .where(eq(schema.users.id, authUser.id));
 
-    // Revoke all API keys - if credentials were compromised, keys must be rotated too
-    await db.delete(schema.apiKeys).where(eq(schema.apiKeys.userId, authUser.id));
+      // Invalidate all other sessions for this user
+      const currentToken = extractToken(request);
+      if (currentToken) {
+        await db
+          .delete(schema.sessions)
+          .where(
+            and(eq(schema.sessions.userId, authUser.id), ne(schema.sessions.id, currentToken)),
+          );
+      }
 
-    await auditFromRequest(request)("PASSWORD_CHANGED", {
-      userId: authUser.id,
-      username: authUser.username,
-    });
+      // Revoke all API keys - if credentials were compromised, keys must be rotated too
+      await db.delete(schema.apiKeys).where(eq(schema.apiKeys.userId, authUser.id));
 
-    return reply.send({ ok: true });
-  });
+      await auditFromRequest(request)("PASSWORD_CHANGED", {
+        userId: authUser.id,
+        username: authUser.username,
+      });
+
+      return reply.send({ ok: true });
+    },
+  );
 
   // GET /api/auth/users (admin only)
   app.get("/api/auth/users", async (request: FastifyRequest, reply: FastifyReply) => {