fix(auth): clear rate limiter cleanup interval on server stop + cap map size (issue #18)

[xdevrobot]

Summary

Fixes HIGH — Memory Leak + Security Bypass in the auth rate limiter. The setInterval cleanup timer created in createAuthMiddleware() was never cleared, holding a reference to the failedAttempts Map and preventing garbage collection. Under distributed attacks, the Map grew unbounded.

Root Cause

1. setInterval created inside createAuthMiddleware() was never stored or cleared
2. unref() only prevents keeping the process alive — it doesn't free the closure reference
3. No way to dispose the timer from ApiServer.stop()
4. No cap on failedAttempts Map size

Changes

src/api/middleware/auth.ts

• Changed return type from MiddlewareHandler to { middleware, dispose } (new AuthMiddleware interface)
• dispose() calls clearInterval() and failedAttempts.clear()
• Added MAX_FAILED_ATTEMPTS_ENTRIES = 10_000 cap — oldest entry evicted when exceeded

src/api/server.ts

• Import and store AuthMiddleware instance during setupRoutes()
• stop() calls authMw.dispose() before closing the server

src/api/tests/api-server.test.ts

• Updated test helper to use authMw.middleware (new return shape)

Security Impact

• Memory leak proportional to attack traffic is eliminated
• Cleanup interval is properly disposed on server stop
• failedAttempts Map is capped at 10,000 entries to prevent distributed brute-force memory exhaustion
• Stale blocked IPs are cleared immediately on server stop

Closes #18

🤖 Generated with Claude Code