add upload rate limiter per IP to backend.

Nest throttler with nullcart-style default profile and upload override via throttleProfiles.

backend/package-lock.json

@@ -13,6 +13,7 @@
                 "@nestjs/config": "^4.0.3",
                 "@nestjs/core": "^11.0.1",
                 "@nestjs/platform-express": "^11.0.1",
+                "@nestjs/throttler": "^6.7.1",
                 "@nestjs/typeorm": "^12.0.2",
                 "altcha-lib": "^2.6.0",
                 "class-transformer": "^0.5.1",
@@ -1995,6 +1996,20 @@
                 "tslib": "^2.1.0"
             }
         },
+        "node_modules/@nestjs/throttler": {
+            "version": "6.7.1",
+            "resolved": "https://registry.npmjs.org/@nestjs/throttler/-/throttler-6.7.1.tgz",
+            "integrity": "sha512-gAyY1AkU+cSK5DCjFOB43xax9oakameH4xZa9kAgqBqSBQZgmv3DZylLV8KyZNzOGhceL3kDVtby+CF8VAdmEA==",
+            "license": "MIT",
+            "engines": {
+                "node": "^20.19.0 || ^22.12.0 || >=24.0.0"
+            },
+            "peerDependencies": {
+                "@nestjs/common": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0 || ^12.0.0",
+                "@nestjs/core": "^7.0.0 || ^8.0.0 || ^9.0.0 || ^10.0.0 || ^11.0.0 || ^12.0.0",
+                "reflect-metadata": "^0.1.13 || ^0.2.0"
+            }
+        },
         "node_modules/@nestjs/typeorm": {
             "version": "12.0.2",
             "resolved": "https://registry.npmjs.org/@nestjs/typeorm/-/typeorm-12.0.2.tgz",