fix(security): rate limiting, forbidNonWhitelisted, Prisma migrations en startup y CI para GHCR

- ThrottlerGuard global: 20 req/min por IP en todos los endpoints
- forbidNonWhitelisted: true en ValidationPipe
- Dockerfile API: prisma migrate deploy antes de arrancar el proceso
- coolify-compose: depends_on api (service_healthy) en web
- GitHub Actions: build y push de imágenes api/web a GHCR en cada push a main

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/Dockerfile

@@ -19,4 +19,5 @@ COPY --from=builder /app/node_modules ./node_modules
 COPY --from=builder /app/packages/database ./packages/database
 USER app
 EXPOSE 3001
-CMD ["node", "dist/main.js"]
+# ponytail: migrate antes de arrancar; si quieres zero-downtime migrations, sepáralas como job previo en Coolify
+CMD ["sh", "-c", "node node_modules/.bin/prisma migrate deploy --schema packages/database/prisma/schema.prisma && node dist/main.js"]

apps/api/src/app.module.ts

@@ -1,5 +1,7 @@
 import { Module } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
+import { ThrottlerModule, ThrottlerGuard } from "@nestjs/throttler";
+import { APP_GUARD } from "@nestjs/core";
 import { HealthModule } from "./health/health.module";
 import { PrismaModule } from "./prisma/prisma.module";
 import { CalculatorModule } from "./calculator/calculator.module";
@@ -25,6 +27,7 @@ import { ConsolidationsModule } from "./consolidations/consolidations.module";
       isGlobal: true,
       envFilePath: ["../../.env", ".env"],
     }),
+    ThrottlerModule.forRoot([{ ttl: 60000, limit: 20 }]),
     PrismaModule,
     HealthModule,
     CalculatorModule,
@@ -44,5 +47,6 @@ import { ConsolidationsModule } from "./consolidations/consolidations.module";
     PaymentsModule,
     ConsolidationsModule,
   ],
+  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
 })
 export class AppModule {}

apps/api/src/main.ts

@@ -30,7 +30,7 @@ async function bootstrap() {
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
-      forbidNonWhitelisted: false,
+      forbidNonWhitelisted: true,
       transform: true,
       transformOptions: { enableImplicitConversion: true },
     }),