feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/tests/sign-in-flow.feature.test.ts

@@ -3,6 +3,7 @@
 
 import { describe, it, expect } from "vitest";
 import { RecordingEventBus } from "@repo/core-testing/instrumentation";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { MockUsersRepository } from "../src/infrastructure/repositories/users.repository.mock";
 import { MockAuthenticationService } from "../src/infrastructure/services/authentication.service.mock";
 import { signInUseCase } from "../src/application/use-cases/sign-in.use-case";
@@ -18,7 +19,9 @@ describe("auth feature: sign-up → sign-in → sign-out", () => {
     const users = new MockUsersRepository([]);
     const auth = new MockAuthenticationService(users);
 
-    const signIn = signInController(signInUseCase(users, auth));
+    const signIn = signInController(
+      signInUseCase(users, auth, new NoopRateLimit()),
+    );
     const signUp = signUpController(
       signUpUseCase(users, auth, new RecordingEventBus(), undefined),
     );