security: add rate limiting and hash share link passwords

[Fengsh0923]

Summary

Two security improvements found during source code audit:

1. Rate Limiting (#3009)

• Add @nestjs/throttler with global default (100 req/60s)
• Stricter on auth: signin 10/min, signup 5/min, reset-password 3/min
• Configurable via THROTTLE_TTL / THROTTLE_LIMIT env vars

2. Share Password Hashing (#3006)

• bcrypt.compare() instead of plaintext ===
• JWT no longer contains plaintext password, uses {shareId, nonce}
• Backward compatible with legacy plaintext JWTs
• Both base-share and view-share flows updated

Test Plan

• Rate limiting triggers 429 after threshold
• Share auth works with existing passwords
• New JWT uses nonce (no password in payload)
• Legacy JWT cookies still work

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ tea-artist
❌ 沈锋

---

沈锋 seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}