fix(ratelimit): split global and login budgets so storms can't lock out login

One shared 100 req / 10 min limiter counted everything —
401s, CORS preflights, even /health — so a bad-token burst
from a second frontend burned the budget and 429'd POST
/api/auth/login too, leaving no way back in short of
waiting out the window or restarting (MemoryStore reset).

New middleware/rateLimit.js holds two limiters, verified
against express-rate-limit@5.5.1:

- apiLimiter (300 / 15 min) skips OPTIONS, /health, and the
  public auth endpoints, so preflights, probes, and login
  attempts never drain real API budget.
- authLimiter (20 / 15 min, successful logins free) guards
  register/login/forgotpassword/resetpassword against
  brute force. 429 there means 20 wrong passwords, never
  a busy API.

Storm-tested with live server: 320 bad-token hits burn the
global budget yet login still returns 200; 25 bad logins
trip only the login limiter while API traffic is untouched.

routes/auth.js

@@ -4,14 +4,15 @@ import express from 'express'
 const router = express.Router()
 import { register, login, getMe, forgotPassword, resetPassword, updateDetails, updatePassword, logout } from '../controllers/auth.js'
 import { protect } from '../middleware/auth.js'
+import { authLimiter } from '../middleware/rateLimit.js'
 
-router.post('/register', register)
-router.post('/login', login)
+router.post('/register', authLimiter, register)
+router.post('/login', authLimiter, login)
 router.get('/logout', logout)
 router.get('/me', protect, getMe)
 router.put('/updatedetails', protect, updateDetails)
-router.post('/forgotpassword', forgotPassword)
-router.put('/resetpassword/:resettoken', resetPassword)
+router.post('/forgotpassword', authLimiter, forgotPassword)
+router.put('/resetpassword/:resettoken', authLimiter, resetPassword)
 router.put('/updatepassword', protect, updatePassword)
 
 export default router