fix(rest): bound buckets and rate limit verified JWT identities - #1389

Overview

The REST limiter retained every bucket indefinitely and reused a resolver that can accept forwarded user identities. REST limits now use verified JWT subjects (or legacy signed userId claims), otherwise client IP. Storage has a hard 10,000-bucket default bound with LRU eviction, and an idle cleanup timer removes expired buckets even without further traffic.

Related Issue

Closes #1269

Changes

• Extract JWT-only resolution from requireAuth.ts, retaining signature, algorithm, expiry and claim validation. Existing authentication keeps its original userId precedence and signed-gateway support; the REST limiter never uses forwarded identities.
• Prefer a valid JWT sub for REST keys, retaining compatibility with existing signed userId tokens. Invalid, expired, inactive or unverifiable tokens use the IP bucket.
• Add optional maxBuckets, defaulting to 10,000, and refresh LRU order on checks, including denied requests. peek remains non-consuming.
• Sweep expired buckets every window using an unref timer; stop when empty. reset and dispose release timers, and later use restarts cleanup. Validate positive integer limits and supported timer intervals.
• Replace outdated REST header-auth test fixtures with signed JWTs and add identity-spoofing, subject-priority, 100k-key load, LRU, idle-expiry and cleanup lifecycle regressions.

Security and Compatibility

Rotating x-user-id cannot obtain fresh REST buckets, including when signed forwarding is enabled for route authentication. JWT subjects are read only after cryptographic verification. Existing IP extraction, fixed-window quotas, 429 body and Retry-After behavior remain unchanged. No dependencies or billing production logic change.

Capacity eviction can reset a displaced client's quota under saturation, as with the existing bounded gateway store; the limit is per process and does not provide distributed coordination. Recent active/denied clients retain their buckets preferentially. Cleanup costs at most one scan of the bounded map per window, and timers do not keep the process alive. Removed custom limiters should call dispose().

Verification Results

Upstream currently lacks package.json and jest.env-setup.cjs after commit 599ab6e. Local validation used copies from that commit's verified parent, excluded from this PR. Installed the existing lockfile with npm ci --ignore-scripts; no dependencies changed.

Workspace-wide build/CI cannot be certified while the missing manifest and baseline errors remain. This change does not alter those unrelated files or weaken validation.