Rate Limiting Alone Won't Stop a Patient Attacker

@nestjs/throttler counts requests per IP. It has no idea what an account is. Here's what that gap actually looks like, and the Redis-backed lockout that closes it.