[BE] Harden creator auth path (rate limit + CORS for FE)

[Kaylahray]

Description

Rate-limit SEP-10 challenge/verify; allow configured frontend origin so creator app can call API locally/prod.

User Story

As a Maintainer,
I want auth usable from the creator frontend safely,
so that SEP-10 login works without wide-open abuse.

Requirements and Context

• Files: backend/src/auth/, main.ts, .env.example
• CORS_ORIGINS; throttle on /auth/*; docs for NEXT_PUBLIC_API_URL

Suggested Implementation

// ThrottlerModule on auth routes
// enableCors({ origin: process.env.CORS_ORIGINS?.split(',') })

Acceptance Criteria

• Auth rate limited
• FE origin accepted via env
• .env.example + README updated

Submission Guidelines

• Branch: feat/be-creator-auth-cors
• Depends on: None
• PR: feat(backend): rate limit auth and CORS for creator FE

[idowuvictor]

Hello, I'd like to work on this issue.

I'll secure the authentication endpoints by adding rate limiting to the SEP-10 challenge/verify routes and configuring CORS to allow only explicitly configured frontend origins via the CORS_ORIGINS environment variable. This will enable both local development and production creator apps to authenticate safely without exposing the API to unrestricted cross-origin requests.

I'll also update .env.example and the README to document CORS_ORIGINS and NEXT_PUBLIC_API_URL, ensuring the creator frontend can be configured correctly. Finally, I'll verify that the auth endpoints are rate-limited, the configured frontend origins are accepted, and the changes remain backward compatible with the existing authentication flow.

[grantfox-oss]

🦊 GrantFox — @idowuvictor has been assigned to this issue as part of the Official Campaign | FWC26 campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #271)
2. Your PR will be reviewed by the Quid-proquo maintainers

Good luck! Track your progress on GrantFox.