add upload rate limiter per IP to backend.

Nest throttler with nullcart-style default profile and upload override via throttleProfiles.

backend/src/AppModule.ts

@@ -1,5 +1,7 @@
 import { Module } from '@nestjs/common';
 import { ConfigModule, ConfigService, registerAs } from '@nestjs/config';
+import { APP_GUARD } from '@nestjs/core';
+import { ThrottlerGuard, ThrottlerModule } from '@nestjs/throttler';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { getAltchaConfig, getAppConfig, getPostgresConfig } from './config';
 import { validate } from './config/validate';
@@ -20,6 +22,22 @@ import { Config } from './types/Config';
                 registerAs('altcha', getAltchaConfig)
             ]
         }),
+        ThrottlerModule.forRootAsync({
+            inject: [ConfigService],
+            useFactory: (configService: ConfigService) => {
+                const { throttle } = configService.get('app') as Config['app'];
+
+                return {
+                    throttlers: [
+                        {
+                            name: 'default',
+                            ttl: throttle.ttlMs,
+                            limit: throttle.limit
+                        }
+                    ]
+                };
+            }
+        }),
         TypeOrmModule.forRootAsync({
             useFactory: (configService: ConfigService) => configService.get('postgres') as Config['postgres'],
             inject: [ConfigService]
@@ -28,6 +46,12 @@ import { Config } from './types/Config';
         AltchaModule,
         StorageModule,
         UploadModule
+    ],
+    providers: [
+        {
+            provide: APP_GUARD,
+            useClass: ThrottlerGuard
+        }
     ]
 })
 export class AppModule {}