fix(#199): implement rate limiting on webhook endpoints

Implements comprehensive rate limiting on all webhook and coordinator endpoints
to prevent DoS attacks. Follows TDD protocol with 14 passing tests.

Implementation:
- Added @nestjs/throttler package for rate limiting
- Created ThrottlerApiKeyGuard for per-API-key rate limiting
- Created ThrottlerValkeyStorageService for distributed rate limiting via Redis
- Configured rate limits on stitcher endpoints (60 req/min)
- Configured rate limits on coordinator endpoints (100 req/min)
- Higher limits for health endpoints (300 req/min for monitoring)
- Added environment variables for rate limit configuration
- Rate limiting logs violations for security monitoring

Rate Limits:
- Stitcher webhooks: 60 requests/minute per API key
- Coordinator endpoints: 100 requests/minute per API key
- Health endpoints: 300 requests/minute (higher for monitoring)

Storage:
- Uses Valkey (Redis) for distributed rate limiting across API instances
- Falls back to in-memory storage if Redis unavailable

Testing:
- 14 comprehensive rate limiting tests (all passing)
- Tests verify: rate limit enforcement, Retry-After headers, per-API-key isolation
- TDD approach: RED (failing tests) → GREEN (implementation) → REFACTOR

Additional improvements:
- Type safety improvements in websocket gateway
- Array type notation standardization in coordinator service

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/websocket/websocket.gateway.ts

@@ -173,19 +173,19 @@ export class WebSocketGateway implements OnGatewayConnection, OnGatewayDisconnec
    */
   private extractTokenFromHandshake(client: Socket): string | undefined {
     // Check handshake.auth.token (preferred method)
-    const authToken = client.handshake.auth?.token;
+    const authToken = client.handshake.auth.token as unknown;
     if (typeof authToken === "string" && authToken.length > 0) {
       return authToken;
     }
 
     // Fallback: check query parameters
-    const queryToken = client.handshake.query?.token;
+    const queryToken = client.handshake.query.token as unknown;
     if (typeof queryToken === "string" && queryToken.length > 0) {
       return queryToken;
     }
 
     // Fallback: check Authorization header
-    const authHeader = client.handshake.headers?.authorization;
+    const authHeader = client.handshake.headers.authorization as unknown;
     if (typeof authHeader === "string") {
       const parts = authHeader.split(" ");
       const [type, token] = parts;