Add per-IP rate-limit / throttle middleware for /api/v1/auth/* #1317

The management API's authentication routes have no per-IP request throttle. /auth/login is protected by per-account lockout after repeated failures, but an attacker can still spread attempts across many usernames from one IP, or hammer other /auth/* routes, without hitting any IP-level ceiling. The public registration route that previously widened this surface has been removed (#1316), so the remaining exposure is login and the token/refresh endpoints.

Add lightweight per-IP throttling (sliding window, configurable threshold, 429 on breach) in front of the /api/v1/auth/* group, keeping the existing account-lockout behavior as a second layer. Ensure the limiter is safe behind the documented management-network proxy setup (trusted-proxy / real-IP resolution) so it throttles the true client, not the proxy.

Follow-up from #1316 / GHSA-3gc6-295r-xm5m.