Verify ALTCHA before upload body parse with single-use replay store.

Run challenge TTL and replay tracking in middleware, remove the guard, and
wire ScheduleModule for pruning used solutions.

backend/src/middlewares/altchaMiddleware.ts

@@ -0,0 +1,29 @@
+import { HttpStatus } from '@nestjs/common';
+import type { RequestHandler } from 'express';
+import { ALTCHA_REQUEST_HEADER } from '../consts/altchaHeader';
+import type { AltchaService } from '../modules/altcha/services/AltchaService';
+import { AltchaVerificationStatus } from '../modules/altcha/types/AltchaVerificationStatus';
+
+const altchaVerificationMessage: Record<Exclude<AltchaVerificationStatus, AltchaVerificationStatus.Ok>, string> = {
+    [AltchaVerificationStatus.Missing]: 'ALTCHA verification required',
+    [AltchaVerificationStatus.Invalid]: 'ALTCHA verification failed',
+    [AltchaVerificationStatus.AlreadyUsed]: 'ALTCHA already used'
+};
+
+export const altchaMiddleware = (altchaService: AltchaService): RequestHandler => {
+    return async (req, res, next) => {
+        try {
+            const altchaHeader = req.get(ALTCHA_REQUEST_HEADER);
+
+            const status = await altchaService.verifySolution(altchaHeader);
+
+            if (status === AltchaVerificationStatus.Ok) {
+                return next();
+            }
+
+            return res.status(HttpStatus.BAD_REQUEST).send({ message: altchaVerificationMessage[status] });
+        } catch (error) {
+            return next(error);
+        }
+    };
+};