feat(core): Make token exchange rate limits configurable via env vars (no-changelog)

[afitzek]

Summary

Makes the IP rate limits on POST /auth/oauth/token and GET/POST /auth/embed configurable via environment variables instead of hardcoded values. Both endpoints already had rate limiting (20 req/min); this PR externalizes those limits into TokenExchangeConfig so operators can tune them per deployment.

Part of the OAuth 2.0 Token Exchange hardening phase. The rate limiting infrastructure and default values were already in place from prior PRs — this PR satisfies the AC that limits must be configurable via environment variables.

New env vars:

• N8N_TOKEN_EXCHANGE_EMBED_LOGIN_PER_MINUTE (default: 20) — IP rate limit for GET/POST /auth/embed
• N8N_TOKEN_EXCHANGE_TOKEN_EXCHANGE_PER_MINUTE (default: 20) — IP rate limit for POST /auth/oauth/token

Key implementation decisions

Config is resolved at module scope via Container.get(TokenExchangeConfig) and referenced directly in route decorators. This works because the config module is imported (and @Config/@Env decorators registered) before the controller module's top-level code runs, so env vars are already applied. The window duration (1 minute) is intentionally not configurable — the env var names encode "per minute" semantics.

Related tickets

• https://linear.app/n8n/issue/IAM-474

Review / Merge checklist

• I have seen this code, I have run this code, and I take responsibility for this code.
• PR title and summary are descriptive. (conventions)
• Docs updated or follow-up ticket created.
• Tests included.
• PR Labeled with Backport to Beta, Backport to Stable, or Backport to v1 (if the PR is an urgent fix that needs to be backported)

[github-actions]

⚠️ Ownership acknowledgement required

Please add or check the following item in your PR description before this can be merged:

- [x] I have seen this code, I have run this code, and I take responsibility for this code.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!