Security: Add rate limiting to auth endpoints (register/login)

[intel352]

Problem

/api/v1/auth/register and /api/v1/auth/login are public endpoints with no rate limiting or throttling. This exposes them to brute-force attacks and credential stuffing.

Fix

Apply the existing ratelimit middleware to auth routes, or add IP-based throttling with progressive backoff. Consider:

• Per-IP rate limit on /login (e.g., 10 attempts/minute)
• Per-IP rate limit on /register (e.g., 5/hour)
• Account lockout after N failed attempts
• Logging of failed auth attempts for security monitoring