fix(auth): add rate limiting to authentication endpoints to prevent brute force attacks

[danialahmad-ucl]

Description

Implements IP-based rate limiting on authentication endpoints (/api/auth/login and /api/auth/register) to protect against brute force attacks.

Fixes #13

Changes Made

• ✅ Created rate limiter middleware using token bucket algorithm
• ✅ Applied rate limiting to /api/auth/login and /api/auth/register
• ✅ Added comprehensive unit tests for rate limiter
• ✅ Updated Swagger documentation with HTTP 429 responses
• ✅ Added golang.org/x/time dependency for rate limiting

Configuration

• Rate Limit: 5 requests per second
• Burst Size: 10 requests
• Scope: Per IP address
• Response: HTTP 429 with error message when limit exceeded

Implementation Details

• Uses token bucket algorithm for smooth rate limiting
• Thread-safe implementation with mutex protection
• Automatic cleanup routine runs hourly to prevent memory leaks
• Rate limiter isolated per IP address

Testing

Run the rate limiter tests:
go test ./internal/middleware/ratelimiter/Test manually with rapid requests:
for i in {1..15}; do curl -X POST http://localhost:8080/api/auth/login
-H "Content-Type: application/json"
-d '{"email":"[email protected]","password":"password123"}'
-w "\nStatus: %{http_code}\n"; doneExpected: First 10 requests succeed, remaining get HTTP 429

Security Impact

• ✅ Prevents brute force password attacks
• ✅ Protects against credential stuffing
• ✅ Mitigates account enumeration attempts
• ✅ Reduces server load from automated attacks

Breaking Changes

None - This is a backward-compatible security enhancement.

[danialahmad-ucl]

@joshua-sajeev have create PR for fix of the issue. Please let me know if further changes are required