feat(security): add Redis-backed app-layer anti-DDoS rate limiting to proxy

src/env.ts

@@ -100,6 +100,12 @@ const schema = z
 		// Redis — strongly recommended in production (required for multi-instance).
 		// Without it, rate limits / shared caches are in-process only.
 		REDIS_URL: z.string().optional(),
+		// App-layer anti-DDoS gate (proxy rate limiter). On by default in
+		// production; set to "false" or "0" to disable without removing it.
+		ANTI_DDOS_ENABLED: z
+			.string()
+			.optional()
+			.transform((value) => value !== "false" && value !== "0"),
 		// Logging level.
 		LOG_LEVEL: z.enum(["debug", "info", "warn", "error"]).optional(),
 		APP_VERSION: z.string().optional(),