🛡️ Sentinel: [CRITICAL] Enable rate limiting middleware

[google-labs-jules]

🛡️ Sentinel: [CRITICAL] Enable rate limiting middleware

🚨 Severity: CRITICAL

💡 Vulnerability

The application had the @fastify/rate-limit middleware registration explicitly commented out in backend/src/app.ts, marked as "DESABILITADO PARA DESENVOLVIMENTO" (Disabled for Development). This meant that in a production deployment, if this code was deployed as-is, the API would have no protection against rate abuse.

🎯 Impact

Without rate limiting, the API is vulnerable to:

• Denial of Service (DoS): Attackers can flood the server with requests, exhausting resources and making the service unavailable for legitimate users.
• Brute Force Attacks: Attackers can attempt to guess credentials or tokens without restriction.
• Resource Exhaustion: API abuse can drive up infrastructure costs (e.g., if utilizing paid 3rd party APIs like the KYC or Price Oracle providers mentioned in config).

🔧 Fix

• Uncommented the rateLimit registration block in backend/src/app.ts.
• The middleware now correctly uses the configured RATE_LIMIT_MAX_REQUESTS and RATE_LIMIT_WINDOW_MS values from envConfig.
• Added a backend/.eslintrc.json file to ensure the codebase can be properly linted, confirming no syntax or style regressions were introduced.

✅ Verification

1. Navigate to backend/.
2. Run npm run lint to confirm code quality (1 non-blocking warning remains).
3. Run npm run build to confirm the application compiles successfully with the middleware enabled.
4. (Manual) Inspect backend/src/app.ts to see that await this.server.register(rateLimit, ...) is no longer commented out.

---

PR created automatically by Jules for task 17108970043232690125 started by @Magnopiro-oficial

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.