[SH-ZMD]

What changed

• Add bounded in-memory login and member-submission rate limiters.
• Use Tomcat-native forwarded-header handling and the validated remote address for login limits.
• Add the protected account-list endpoint needed by the existing admin account workflow.
• Prevent administrators from disabling themselves or removing their own administrator role.
• Limit audit-log reads to the newest 200 entries and return a consistent 415 response for unsupported content types.
• Add focused limiter, controller, security, and account-service regression tests.

Why

The existing backend needed protection against repeated login and submission attempts, and the frontend account-management workflow lacked a safe list endpoint. The forwarded-address handling also needed to resist spoofed prefix values behind a proxy.

Validation

• .\\gradlew.bat --no-daemon clean test bootJar: passed on Temurin JDK 25.0.3.
• Real Tomcat proxy-limit check returned 401 for the first five attempts, 429 for the sixth attempt from the same validated address, and 401 from a different validated address.
• Local health and public-home APIs returned HTTP 200.
• git diff --check: passed.