fix(security): resolve rate limit bypass for unauthenticated requests

[aryankshl]

Summary

This PR fixes a critical logic flaw in the RateLimitAspect that allowed unauthenticated users (such as those on the /register and /login endpoints) to bypass rate limiting entirely.

• Deterministic Key Generation: Refactored getRateLimitKey to consistently use the client's IP address for unauthenticated users.
• Proxy-Aware IP Detection: Enhanced getClientIpAddress to check the X-Forwarded-For header, ensuring rate limiting works correctly behind Docker or Nginx proxies.
• Fallback Logic: Guaranteed that even if IP detection fails, the key remains stable rather than randomized.

Linked issue

Closes #206

How to test

• Start the environment: Run docker compose up -d and ./mvnw spring-boot:run
• Execute a "Spam" Script: Run the following bash loop to simulate a registration burst:

for i in {1..10}; do 
  curl -s -o /dev/null -w "%{http_code}\n" -X POST http://localhost:8080/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"username":"test_user_'$i'", "password":"Password123!"}'
done 

Notes / Risk

• Risk: Users sharing a single Public IP (like a large office or university) will share the same rate-limit bucket. However, given the current limit of 5 requests per minute for registration, this is a standard and acceptable security trade-off.
• Dependency: Requires Bucket4j and Caffeine which are already present in the project.

[Copilot]

Pull request overview

This PR hardens backend rate limiting by ensuring unauthenticated requests are deterministically bucketed (primarily by client IP), including better support for deployments behind proxies via X-Forwarded-For.

Changes:

• Refactors rate-limit key generation to avoid randomized fallback keys for anonymous requests.
• Adds X-Forwarded-For support in client IP detection to improve correctness behind reverse proxies.
• Adds key prefixes (IP:, USER:, ANON:) to reduce key-space ambiguity.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[DenizAltunkapan]

@aryankshl please fix the failing workflow

[DenizAltunkapan]

@aryankshl Thank you for your contribution