Add rate limiting to authentication endpoints

[darshacharya]

Description

The login and registration endpoints have no rate limiting, making them vulnerable to credential stuffing and registration abuse.

Requirements

• Add rate limiting to POST /api/auth/login (e.g., 5 attempts per minute per IP)
• Add rate limiting to POST /api/auth/register (e.g., 3 registrations per hour per IP)
• Return 429 Too Many Requests with a Retry-After header when rate limit is exceeded
• Consider using slowapi (FastAPI-compatible rate limiter based on limits)

Tech Notes

• File: backend/app/routers/auth.py
• slowapi integrates well with FastAPI: https://github.com/laurentS/slowapi
• Store rate limit state in memory for dev, Redis for production
• Add slowapi to backend/requirements.txt

Acceptance Criteria

• Login is rate-limited per IP
• Registration is rate-limited per IP
• 429 response is returned with appropriate message
• Rate limit headers are included in responses
• Legitimate users are not impacted under normal use