Add auth endpoint rate limiting

[Jorel97]

/claim #743

Closes #1977

Summary

• Added a dedicated authLimiter for credential-sensitive auth endpoints.
• Applied the stricter limiter to POST /api/auth/register, POST /api/auth/login, and POST /api/auth/refresh while leaving non-auth routes on the existing general API limiter.
• Updated the API test script to use an explicit src/tests/*.test.js glob so the Node test runner executes the test files reliably.
• Added regression coverage proving the 11th login attempt is blocked with HTTP 429 and a structured JSON error.

Demo

Short demo video: https://github.com/Jorel97/bounty-demo-assets/raw/main/securebanana/securebanana-1977-auth-rate-limit-demo.mp4

Validation

• npm test
  • 3 tests passed
  • includes authRateLimit.test.js for the strict auth limiter behavior
• git diff --check