fix(security): correct Docker rate limit defaults

- LOGIN_ATTEMPT_LIMIT: 500 -> 30 in Dockerfile (matching code default)
- RATE_LIMIT_PER_MIN=0 now means no global limit (50K ceiling) instead
  of 1 req/min, preserving backward compatibility with existing deploys
  while keeping per-route limits (login brute-force) active

apps/api/src/index.ts

@@ -156,9 +156,9 @@ app.addHook("onSend", async (_request, reply) => {
 });
 
 // Always register rate-limit plugin so per-route limits (login brute-force protection) work.
-// RATE_LIMIT_PER_MIN defaults to 300 via env schema; floor at 1 as a safety net.
+// RATE_LIMIT_PER_MIN=0 means no global limit (per-route limits still apply).
 await app.register(rateLimit, {
-  max: Math.max(env.RATE_LIMIT_PER_MIN, 1),
+  max: env.RATE_LIMIT_PER_MIN > 0 ? env.RATE_LIMIT_PER_MIN : 50_000,
   timeWindow: "1 minute",
   allowList: (request) => !request.url.startsWith("/api/"),
 });

docker/Dockerfile

@@ -271,7 +271,7 @@ ENV PORT=1349 \
     MAX_SPLIT_GRID=100 \
     MAX_PDF_PAGES=0 \
     SESSION_DURATION_HOURS=168 \
-    LOGIN_ATTEMPT_LIMIT=500 \
+    LOGIN_ATTEMPT_LIMIT=30 \
     LOG_LEVEL=info \
     TRUST_PROXY=true \
     OIDC_ENABLED=false \