fix issue

apps/edr-freight-api/src/modules/otp/otp.controller.ts

@@ -19,6 +19,9 @@ function toTarget(phone?: string, email?: string): OtpTarget {
   throw new BadRequestException("phone or email is required");
 }
 
+// TODO: these public routes need per-target + per-IP rate limiting (a NestJS
+// ThrottlerGuard / @Throttle on /otp/send and /otp/verify). No Throttler is
+// wired into the app yet; add @nestjs/throttler and apply it here.
 @Controller("otp")
 @Public()
 export class OtpController {