feat: add rate limiting to authentication endpoints

- Add rate limiter middleware (10 requests/minute per IP)
- Apply rate limiting to POST /api/auth/register and /api/auth/login
- Prevents brute force attacks and registration spam
- Automatic cleanup of old request records

Closes security issue: No rate limiting on auth endpoints

cmd/server/main.go

@@ -4,6 +4,7 @@ import (
 	"bookmann/internal/config"
 	"bookmann/internal/database"
 	"bookmann/internal/handlers"
+	ratelimit "bookmann/internal/middleware"
 	"bookmann/templates"
 	"bytes"
 	"context"
@@ -17,7 +18,7 @@ import (
 	"github.com/jackc/pgx/v5/pgxpool"
 	"github.com/labstack/echo-jwt/v4"
 	"github.com/labstack/echo/v4"
-	"github.com/labstack/echo/v4/middleware"
+	echomiddleware "github.com/labstack/echo/v4/middleware"
 )
 
 // CustomValidator wraps the go-playground validator
@@ -49,13 +50,17 @@ func main() {
 	e.Validator = &CustomValidator{validator: validator.New()}
 
 	// Middleware
-	e.Use(middleware.Logger())
-	e.Use(middleware.Recover())
-	e.Use(middleware.CORS())
+	e.Use(echomiddleware.Logger())
+	e.Use(echomiddleware.Recover())
+	e.Use(echomiddleware.CORS())
 
-	// Auth routes (no auth required)
-	e.POST("/api/auth/register", authHandler.Register)
-	e.POST("/api/auth/login", authHandler.Login)
+	// Rate limiter for auth endpoints
+	rateLimiter := ratelimit.NewRateLimiter(ratelimit.DefaultRateLimiterConfig())
+	rateLimitMiddleware := ratelimit.RateLimiterMiddleware(rateLimiter)
+
+	// Auth routes (no auth required, but rate limited)
+	e.POST("/api/auth/register", rateLimitMiddleware(authHandler.Register))
+	e.POST("/api/auth/login", rateLimitMiddleware(authHandler.Login))
 
 	// JWT middleware for protected routes
 	jwtMiddleware := echojwt.WithConfig(echojwt.Config{