Add massive scaling tests for TrackUserProtection under high-volume load (JhaSourav07#3033)

## Description

Fixes JhaSourav07#2964

The `TrackUserProtection` class at
`services/security/track-user-protection.ts` maintains an internal
`Map`-based write cooldown cache but had no tests verifying behavior
under high-volume concurrent user operations. Bulk format validation,
username normalization at scale, cache reset correctness after thousands
of writes, and execution time bounds were all untested.

## Pillar

- [ ] 🎨 Pillar 1 — New Theme Design
- [ ] 📐 Pillar 2 — Geometric SVG Improvement
- [ ] 🕐 Pillar 3 — Timezone Logic Optimization
- [x] 🛠️ Other (Bug fix, refactoring, docs)

## Visual Preview

Not applicable — this is a test-only change.

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally.
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors (CI will fail otherwise).
- [x] I have run `npm run test` and all tests pass locally.
- [x] I have run `npm run test:coverage` and branch coverage is at or
above 70%.
- [x] My commits follow the Conventional Commits format.
- [ ] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have started the repo.
- [x] I have made sure that i have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse "premium quality" aesthetic
standard.
- [ ] (Recommended) I joined the CommitPulse Discord server for faster
collaboration, mentorship, and PR support.

Author: JhaSourav07

services/security/track-user-protection.massive-scaling.test.ts

@@ -0,0 +1,67 @@
+import { describe, it, expect, vi } from 'vitest';
+import { TrackUserProtection } from './track-user-protection';
+
+describe('TrackUserProtection massive scaling behavior', () => {
+  it('records writes for 1000 unique usernames and enforces cooldown on all', () => {
+    const tracker = TrackUserProtection.getInstance();
+    tracker.reset();
+
+    for (let i = 0; i < 1000; i++) {
+      tracker.recordWrite(`user${i}`);
+    }
+
+    for (let i = 0; i < 1000; i++) {
+      expect(tracker.isWriteAllowed(`user${i}`)).toBe(false);
+    }
+  });
+
+  it('validates format for 1000 usernames without throwing', () => {
+    const tracker = TrackUserProtection.getInstance();
+
+    expect(() => {
+      for (let i = 0; i < 1000; i++) {
+        tracker.validateFormat(`user${i}`);
+      }
+    }).not.toThrow();
+  });
+
+  it('normalizes usernames consistently under high volume', () => {
+    const tracker = TrackUserProtection.getInstance();
+    tracker.reset();
+
+    for (let i = 0; i < 500; i++) {
+      tracker.recordWrite(`  USER${i}  `);
+    }
+
+    for (let i = 0; i < 500; i++) {
+      expect(tracker.isWriteAllowed(`user${i}`)).toBe(false);
+    }
+  });
+
+  it('clears the full cache on reset after bulk writes', () => {
+    const tracker = TrackUserProtection.getInstance();
+    tracker.reset();
+
+    for (let i = 0; i < 1000; i++) {
+      tracker.recordWrite(`user${i}`);
+    }
+
+    tracker.reset();
+
+    for (let i = 0; i < 1000; i++) {
+      expect(tracker.isWriteAllowed(`user${i}`)).toBe(true);
+    }
+  });
+
+  it('completes format validation for 10000 usernames within acceptable time', () => {
+    const tracker = TrackUserProtection.getInstance();
+
+    const start = performance.now();
+    for (let i = 0; i < 10000; i++) {
+      tracker.validateFormat(`user${i}-test`);
+    }
+    const elapsed = performance.now() - start;
+
+    expect(elapsed).toBeLessThan(2000);
+  });
+});