chore: upgrade express-rate-limit 7.5.1 → 8.3.1 (IPv6 security fix)

- Fixes IPv6 rate limit bypass vulnerability (GHSA-46wh-pxpv-q5gq)
- IPv6 addresses now masked to /56 subnet by default
- Updated custom keyGenerators to use ipKeyGenerator() helper
- 5 new TDD tests for v8 features (ipKeyGenerator, IPv6 masking)
- 672 tests passing, 0 TS errors, 0 npm audit vulnerabilities

src/__tests__/rate-limit-v8.test.ts

@@ -0,0 +1,41 @@
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+
+// Test express-rate-limit v8 upgrade compatibility
+describe("express-rate-limit v8 upgrade", () => {
+  it("should export rateLimit as default export", async () => {
+    const mod = await import("express-rate-limit");
+    expect(typeof mod.default).toBe("function");
+  });
+
+  it("should export ipKeyGenerator helper (v8 feature)", async () => {
+    const mod = await import("express-rate-limit");
+    // v8 exports ipKeyGenerator for IPv6 subnet masking
+    expect(typeof (mod as any).ipKeyGenerator).toBe("function");
+  });
+
+  it("ipKeyGenerator should return IPv4 addresses unchanged", async () => {
+    const { ipKeyGenerator } = await import("express-rate-limit") as any;
+    const result = ipKeyGenerator("192.168.1.1");
+    expect(result).toBe("192.168.1.1");
+  });
+
+  it("ipKeyGenerator should mask IPv6 addresses to /56 by default", async () => {
+    const { ipKeyGenerator } = await import("express-rate-limit") as any;
+    const ip1 = ipKeyGenerator("2001:db8:85a3:1234:1111:2222:3333:4444");
+    const ip2 = ipKeyGenerator("2001:db8:85a3:1256:aaaa:bbbb:cccc:dddd");
+    // Same /56 prefix → same result
+    expect(ip1).toBe(ip2);
+  });
+
+  it("rateLimit should accept standardHeaders: true", async () => {
+    const { default: rateLimit } = await import("express-rate-limit");
+    // Should not throw
+    const limiter = rateLimit({
+      windowMs: 60000,
+      max: 100,
+      standardHeaders: true,
+      legacyHeaders: false,
+    });
+    expect(typeof limiter).toBe("function");
+  });
+});