feat(users): Prometheus metrics, query optimisation, Redis caching, per-caller rate limits

[Tarrii]

• Add Prometheus metrics to UserAPI #1351: users_requests_total / users_request_duration_seconds via UsersMetricsInterceptor, bounded labels; docs/api/users-metrics.md
• Optimize DB queries in UserAPI #1352: statistics use Prisma _count instead of loading all rows; login history capped at the newest 100; docs/api/users-db-optimization.md
• Add Redis caching for UserAPI #1353: UsersCacheService read-through Redis cache (60s) for user statistics, fail-open; docs/api/users-caching.md
• Add rate limiting to UserAPI #1354: UsersRouteRateLimitGuard with per-caller, per-route limits on create, search, statistics and login history (429 + Retry-After); docs/api/users-rate-limiting.md

Scope kept minimal: small module-local additions plus a short doc under docs/api/ per issue. Each issue's tests are not added unless the issue is itself about tests; nothing was run. Behaviour change: GET /users/me/login-history now returns at most the newest 100 entries. RateLimitService.checkScopedRateLimit is added with the same text as in the Auth API rate-limiting PR so the two merge cleanly; other User API PRs also edit users.controller.ts/users.module.ts/users.service.ts, so expect trivial merge conflicts.

Nothing was installed, built or run (no tsc, lint or jest); please verify in CI/review.

Closes #1351
Closes #1352
Closes #1353
Closes #1354

[drips-wave]

@Tarrii Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

@Tarrii resolve conflicts