fix(security): rate limiting, forbidNonWhitelisted, Prisma migrations en startup y CI para GHCR

- ThrottlerGuard global: 20 req/min por IP en todos los endpoints
- forbidNonWhitelisted: true en ValidationPipe
- Dockerfile API: prisma migrate deploy antes de arrancar el proceso
- coolify-compose: depends_on api (service_healthy) en web
- GitHub Actions: build y push de imágenes api/web a GHCR en cada push a main

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/api/src/app.module.ts

@@ -1,5 +1,7 @@
 import { Module } from "@nestjs/common";
 import { ConfigModule } from "@nestjs/config";
+import { ThrottlerModule, ThrottlerGuard } from "@nestjs/throttler";
+import { APP_GUARD } from "@nestjs/core";
 import { HealthModule } from "./health/health.module";
 import { PrismaModule } from "./prisma/prisma.module";
 import { CalculatorModule } from "./calculator/calculator.module";
@@ -25,6 +27,7 @@ import { ConsolidationsModule } from "./consolidations/consolidations.module";
       isGlobal: true,
       envFilePath: ["../../.env", ".env"],
     }),
+    ThrottlerModule.forRoot([{ ttl: 60000, limit: 20 }]),
     PrismaModule,
     HealthModule,
     CalculatorModule,
@@ -44,5 +47,6 @@ import { ConsolidationsModule } from "./consolidations/consolidations.module";
     PaymentsModule,
     ConsolidationsModule,
   ],
+  providers: [{ provide: APP_GUARD, useClass: ThrottlerGuard }],
 })
 export class AppModule {}

apps/api/src/main.ts

@@ -30,7 +30,7 @@ async function bootstrap() {
   app.useGlobalPipes(
     new ValidationPipe({
       whitelist: true,
-      forbidNonWhitelisted: false,
+      forbidNonWhitelisted: true,
       transform: true,
       transformOptions: { enableImplicitConversion: true },
     }),