fix: Rate-Limit pro IPv6-/64 statt pro Einzeladresse

Der Standard-ThrottlerGuard trackt die volle req.ip. Ein IPv6-Client
kann innerhalb seines /64 beliebig Adressen rotieren und so die
Login-/Refresh-/SSO-Limits umgehen. Neuer ClientIpThrottlerGuard
liefert IPv4 unveraendert, IPv4-mapped als IPv4 und IPv6 als /64-Praefix.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Backend/src/common/throttler/client-ip-throttler.guard.spec.ts

@@ -0,0 +1,26 @@
+import { ClientIpThrottlerGuard } from './client-ip-throttler.guard';
+
+describe('ClientIpThrottlerGuard.getTracker', () => {
+  // getTracker is protected and needs none of the guard's dependencies.
+  const guard = Object.create(
+    ClientIpThrottlerGuard.prototype,
+  ) as ClientIpThrottlerGuard & {
+    getTracker(req: Record<string, any>): Promise<string>;
+  };
+
+  it('tracks IPv6 clients by their /64 prefix', async () => {
+    await expect(guard.getTracker({ ip: '2001:db8:1:2::9' })).resolves.toBe(
+      '2001:db8:1:2::/64',
+    );
+  });
+
+  it('tracks IPv4 clients by address', async () => {
+    await expect(guard.getTracker({ ip: '203.0.113.7' })).resolves.toBe(
+      '203.0.113.7',
+    );
+  });
+
+  it('falls back to a stable key when req.ip is missing', async () => {
+    await expect(guard.getTracker({})).resolves.toBe('unknown');
+  });
+});