Add rate limiting to authentication endpoints

[BunsDev]

Problem

The /api/auth/login and /api/auth/logout endpoints have no rate limiting, making them vulnerable to brute-force credential attacks. This is acknowledged as a known gap in the codebase.

Proposed Solution

Implement IP-based rate limiting for auth endpoints:

1. In-memory rate limiter — Use a sliding window counter per IP address
2. Configuration — Configurable max attempts (default: 5) and window duration (default: 15 minutes)
3. Response — Return 429 Too Many Requests with Retry-After header when limit exceeded
4. Logging — Log rate limit events for security auditing

Acceptance Criteria

• /api/auth/login is rate limited (default: 5 attempts per 15-minute window per IP)
• Rate-limited requests receive a 429 response with Retry-After header
• Rate limit state resets after the window expires
• Successful logins reset the counter for that IP
• Rate limit events are logged
• Unit tests cover limit enforcement, reset, and edge cases
• No impact on non-auth endpoints

Notes

• For a local-first app, an in-memory store (Map with TTL cleanup) is sufficient — no need for Redis
• Consider using a lightweight library like rate-limiter-flexible if it simplifies implementation

🤖 Generated with Claude Code