E1: Add rate limiting to auth endpoints

[davidortinau]

Summary

Protect auth endpoints from brute force attacks.

Tasks

• Limit login attempts (5/min per IP)
• Limit registration (10/hr per IP)
• Use ASP.NET Core rate limiting middleware
• Return 429 Too Many Requests

Depends on: D4