[hayor1]

Summary

• Read KYC submission limits from KYC_MAX_SUBMISSIONS and KYC_WINDOW_MINUTES, with validated defaults of 3 and 60.
• Add a database-backed IP fallback for requests without an authenticated user, including a migration and supporting index.
• Verify excess submissions return 429 with a Retry-After header and that the IP fallback records the request identity.

Validation

• npm test -- --runTestsByPath src/middleware/rateLimitKyc.test.ts — passed (2 tests).
• npm run lint reports pre-existing errors in notification template modules and tests, unrelated to the KYC changes.
• Full diff scan and git diff --check — passed.

Closes #485