security: remove .env from tracking (contains secrets)

apps/api/src/app.ts

@@ -8,7 +8,7 @@ import { swaggerSpec } from './config/swagger';
 import { traceMiddleware } from './middleware/trace';
 import { authMiddleware } from './middleware/auth';
 import { csrfMiddleware } from './middleware/csrf';
-import { globalLimiter, mutateLimiter, sensitiveLimiter } from './middleware/rate-limit';
+import { globalLimiter, mutateLimiter, sensitiveLimiter, mnemonicRevealLimiter } from './middleware/rate-limit';
 import { errorHandler } from './middleware/error-handler';
 import walletRoutes from './routes/wallet.routes';
 import vaultRoutes from './routes/vault.routes';
@@ -51,11 +51,13 @@ app.use('/api', globalLimiter);
 // ── PROTECTED endpoints (JWT + CSRF) ─────────────────────────────────────────
 const protect = [authMiddleware, csrfMiddleware];
 
-// Sensitive (send / vault) — самый строгий лимит
+// Sensitive — самый строгий лимит. Каждый POST/PUT защищён JWT + CSRF.
+app.use('/api/wallets/create', ...protect, sensitiveLimiter);
+app.use('/api/wallets/mnemonic/reveal', ...protect, mnemonicRevealLimiter);
 app.use('/api/wallets/:chain/send', ...protect, sensitiveLimiter);
 app.use('/api/vault', ...protect, sensitiveLimiter, vaultRoutes);
 
-// Mutating (создание кошельков / broadcast / build) — повышенный лимит
+// Mutating (proxy + read endpoints) — повышенный лимит
 app.use('/api/wallets', ...protect, mutateLimiter, walletRoutes);
 app.use('/api/relay', ...protect, mutateLimiter, relayProxyRoutes);
 app.use('/api/tron', ...protect, mutateLimiter, tronProxyRoutes);
@@ -64,6 +66,11 @@ app.use('/api/tron/swap', ...protect, mutateLimiter, tronSwapProxyRoutes);
 app.use('/api/btc', ...protect, mutateLimiter, btcProxyRoutes);
 app.use('/api/bsc/swap', ...protect, mutateLimiter, bscSwapProxyRoutes);
 
+// 404 для всего что не сматчилось выше — единый JSON-ответ, не express default text
+app.use((_req, res) => {
+  res.status(404).json({ success: false, error: 'Not found' });
+});
+
 app.use(errorHandler);
 
 export default app;