fix: add rate limiting to auth service endpoints

[jakebromberg]

Summary

• Adds express-rate-limit middleware to the auth service (apps/auth/app.ts), limiting auth endpoints to 10 requests per 15-minute window per IP.
• Login, password reset, and anonymous sign-in were previously unbounded, leaving them vulnerable to brute-force attacks.
• Adds a unit test that verifies rate limiting configuration is present in the auth app source.

Test plan

• Unit test tests/unit/auth/rate-limiting.test.ts passes (verifies express-rate-limit import, rateLimit() config, and middleware ordering before the auth handler)
• Manual smoke test: hit /auth/sign-in/email more than 10 times in 15 minutes and confirm 429 response

Made with Cursor