feat: rate limit authentication endpoints

[GitAddRemote]

Summary

• Registers ThrottlerModule globally in AppModule with configurable default limits (100 req / 60s via THROTTLE_LIMIT / THROTTLE_TTL env vars)
• Applies ThrottlerGuard as a global APP_GUARD so all endpoints are protected by default
• Adds stricter per-endpoint @Throttle limits on sensitive auth routes:
  • POST /auth/login: 10 req / 60s (AUTH_LOGIN_THROTTLE_LIMIT / AUTH_LOGIN_THROTTLE_TTL)
  • POST /auth/register: 5 req / 60s (AUTH_REGISTER_THROTTLE_LIMIT / AUTH_REGISTER_THROTTLE_TTL)
  • POST /auth/forgot-password: 5 req / 60s (AUTH_FORGOT_THROTTLE_LIMIT / AUTH_FORGOT_THROTTLE_TTL)
• All limits are env-configurable with sensible defaults
• 429 responses include Retry-After header via ThrottlerGuard defaults
• Updated .env.example with all new rate-limiting variables

Test plan

• Start the backend with pnpm dev:backend
• Hit POST /auth/login 11 times within 60 seconds — expect 429 on the 11th request with a Retry-After header
• Verify normal endpoints (e.g. GET /) still accept traffic up to the 100-req default limit
• Set AUTH_LOGIN_THROTTLE_LIMIT=3 in .env and verify 429 occurs on the 4th request

Closes #95