feat: add IP rate limit to POST /publishers (#38)

[euniceamoni]

Apply a sliding-window IP rate limiter to the publisher registration endpoint so unlimited account and API-key creation from a single IP is no longer possible.

Changes:

• config.ts: add RATE_LIMIT_REGISTER_IP_MAX (default 10) and RATE_LIMIT_REGISTER_IP_WINDOW_MS (default 1 hour) to envSchema
• rateLimiters.ts: export registerIpRateLimit via createIpRateLimiter
• publishers.ts: mount registerIpRateLimit before validate() on POST /publishers; exceeding the limit returns 429 RATE_LIMITED
• publishers.register-rate-limit.test.ts: 6 new tests covering header values, 429 shape, window reset, per-IP isolation, and route wiring
• publishers.test.ts: fix pre-existing failure — replace invalid Stellar address "GALICE" with a real 56-char G... key so schema passes
• publishers.webhooks.test.ts: add registerIpRateLimit pass-through to the rateLimiters mock (pre-existing omission)
• .env.example: document the two new env vars
• README.md: add Registration row to the rate-limiting table and an explanatory paragraph closes POST /publishers has no rate limit and no email verification #38

[vercel]

@euniceamoni is attempting to deploy a commit to the work Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@euniceamoni Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits