feat: add Redis-backed API rate limits

[snkk2x-collab]

Summary

Implements Redis-backed public API rate limiting for #42 using Upstash Redis REST without adding a production SDK dependency.

Changes

• Added a reusable rate-limit.middleware.ts with route-specific limits:
  • POST /api/auth/challenge: 10/min per IP
  • POST /api/auth/*/signed: 5/min per IP
  • POST /api/events/report: 100/min per API key
  • GET /api/user/{wallet}/score: 60/min per lender API key
• Returns HTTP 429 with Retry-After and readable JSON when the limit is exceeded.
• Fails open with a warning if Upstash is not configured or temporarily unavailable.
• Added Vitest coverage for allow-without-Redis, 429 responses, and Redis failure fallback.
• Documented UPSTASH_REDIS_REST_URL and UPSTASH_REDIS_REST_TOKEN in .env.example and README.

Validation

• pnpm --dir Server exec vitest run src/middleware/__tests__/rate-limit.middleware.test.ts
• pnpm --dir Server exec vitest run
• pnpm --dir Server exec tsc --noEmit --declaration false

Closes #42