feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

coverage/summary.json

@@ -1,33 +1,33 @@
 {
-  "generatedAt": "2026-05-20T08:59:30.996Z",
-  "commit": "24b2490",
+  "generatedAt": "2026-05-20T09:21:52.321Z",
+  "commit": "91d7a24",
   "repo": {
-    "statements": 97.43,
-    "branches": 92.35,
+    "statements": 97.38,
+    "branches": 92.39,
     "functions": 97.21,
-    "lines": 97.43,
+    "lines": 97.38,
     "counts": {
-      "lf": 5910,
-      "lh": 5758,
-      "brf": 1190,
-      "brh": 1099,
-      "fnf": 358,
-      "fnh": 348
+      "lf": 5948,
+      "lh": 5792,
+      "brf": 1196,
+      "brh": 1105,
+      "fnf": 359,
+      "fnh": 349
     }
   },
   "byPackage": {
     "@repo/auth": {
-      "statements": 94,
-      "branches": 92.11,
+      "statements": 93.81,
+      "branches": 92.5,
       "functions": 100,
-      "lines": 94,
+      "lines": 93.81,
       "counts": {
-        "lf": 834,
-        "lh": 784,
-        "brf": 114,
-        "brh": 105,
-        "fnf": 45,
-        "fnh": 45
+        "lf": 872,
+        "lh": 818,
+        "brf": 120,
+        "brh": 111,
+        "fnf": 46,
+        "fnh": 46
       }
     },
     "@repo/blog": {