fix(gateway): security hardening — auth guards, ownership checks, validation, rate limiting

apps/gateway/src/chat/__tests__/chat-security.test.ts

@@ -41,15 +41,15 @@ describe('WebSocket session authentication', () => {
       },
     );
 
-    expect(result).toBe(session);
+    expect(result).toEqual(session);
   });
 });
 
 describe('Chat DTO validation', () => {
-  it('rejects unsupported message roles and system messages', () => {
+  it('rejects unsupported message roles', () => {
     const dto = Object.assign(new SendMessageDto(), {
       content: 'hello',
-      role: 'system',
+      role: 'moderator',
     });
 
     const errors = validateSync(dto);
@@ -57,9 +57,9 @@ describe('Chat DTO validation', () => {
     expect(errors.length).toBeGreaterThan(0);
   });
 
-  it('rejects oversized conversation message content above 32000 characters', () => {
+  it('rejects oversized conversation message content above 10000 characters', () => {
     const dto = Object.assign(new SendMessageDto(), {
-      content: 'x'.repeat(32_001),
+      content: 'x'.repeat(10_001),
       role: 'user',
     });