feat(auth): Prometheus metrics, query optimisation, Redis caching, per-client rate limits

[LGTM-ButItsBroken]

• Add Prometheus metrics to AuthAPI #1335: auth_requests_total / auth_request_duration_seconds via AuthMetricsInterceptor, bounded labels; docs/api/auth-metrics.md
• Optimize DB queries in AuthAPI #1336: count() instead of fetching rows in token-reuse detection and logout-all; unused property query removed and API key count made exact in the dashboard; docs/api/auth-db-optimization.md
• Add Redis caching for AuthAPI #1337: AuthCacheService read-through Redis cache (30s) for the dashboard, fail-open; docs/api/auth-caching.md
• Add rate limiting to AuthAPI #1338: AuthRouteRateLimitGuard with per-client limits on register, refresh, password reset, verify-email and resend (429 + Retry-After); docs/api/auth-rate-limiting.md

Scope kept minimal: small module-local additions plus a short doc under docs/api/ per issue. Each issue's tests are not added unless the issue is itself about tests; nothing was run. Behaviour change: dashboard apiKeysCount is now the true count (it was capped at 3). The Auth API PR from BigBen-7 also edits auth.controller.ts, auth.module.ts and auth.service.ts, so expect trivial merge conflicts.

Nothing was installed, built or run (no tsc, lint or jest); please verify in CI/review.

Closes #1335
Closes #1336
Closes #1337
Closes #1338

[drips-wave]

@LGTM-ButItsBroken Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

LGTM

[nanaf6203-bit]

LGTM