sec: Add rate limiting to token endpoint

[Nlkomaru]

Summary

The token endpoint currently has no rate limiting, making it vulnerable to brute force attacks.

Problem

• No protection against credential stuffing
• No protection against token endpoint abuse
• Could lead to DoS through resource exhaustion

Solution

• Implement rate limiting per client_id
• Implement rate limiting per IP address
• Consider using Ktor rate limiting plugin or custom implementation

Related Files

• core/src/main/kotlin/party/morino/mineauth/core/web/router/auth/oauth/TokenRouter.kt
• core/src/main/kotlin/party/morino/mineauth/core/web/router/auth/oauth/OAuthRouter.kt

Considerations

• Balance between security and legitimate use
• Consider exponential backoff for repeated failures