Auth service challenge ttl desync

[mikkyvans0-source]

All 8 tests pass.
Closes #182

Update Todos

Add getTtl method to RedisService

Store nonce with issuedAt timestamp in generateChallenge

Validate app-level TTL on login path

Update unit tests to cover TTL desync scenarios

Run tests to verify no regressions
All 8 tests pass. Here's the full diff summary:

src/auth/auth.service.ts
Added ChallengeRecord { nonce, issuedAt } interface at the top of the file.
generateChallenge — stores JSON.stringify({ nonce, issuedAt: Date.now() }) instead of the raw nonce string. Redis SETEX TTL is unchanged (300s).
login — parses the JSON record, then enforces elapsedSeconds >= NONCE_TTL_SECONDS using Date.now() as the app-layer clock. Redis TTL is now a backstop only. Corrupt/legacy (non-JSON) values are caught, the key is cleaned up, and a 401 is returned.
src/redis/redis.service.ts
Added ttl(key): Promise<number | null> — wraps ioredis.ttl() with the same graceful-degradation pattern as the other methods.
src/auth/auth.service.spec.ts
Updated existing tests to supply the new JSON record format via a makeRecord(nonce, ageSeconds) helper.
Added 4 new TTL desync tests covering: exact boundary, past boundary (key still in Redis), just inside window, and legacy raw-string (corrupt) nonce