14.10 API Design & Rate Limiting

Strict payload schema validation, anti-negative number guards, and IP rate limiting on login routes.