feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/di/bind-dev-seed.ts

@@ -10,6 +10,7 @@ import {
   assertFeatureConformance,
   wireUseCase,
 } from "@repo/core-shared/conformance";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { authManifest } from "../feature.manifest.js";
 import { authContainer } from "./container.js";
 import { AUTH_SYMBOLS } from "./symbols.js";
@@ -85,12 +86,13 @@ export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignInUseCase,
     factory: signInUseCase,
-    deps: [repo, authService],
+    deps: [repo, authService, ctx.rateLimit ?? new NoopRateLimit()],
     feature: "auth",
     layer: "use-case",
     name: "signIn",
     tracer,
     logger,
+    rateLimit: ctx.rateLimit ?? new NoopRateLimit(),
   });
   const wrappedSignUp = wireUseCase({
     container: authContainer,

packages/auth/src/di/bind-production.ts

@@ -10,6 +10,7 @@ import {
   assertFeatureConformance,
   wireUseCase,
 } from "@repo/core-shared/conformance";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { authManifest } from "../feature.manifest";
 import { authContainer } from "./container";
 import { AUTH_SYMBOLS } from "./symbols";
@@ -77,12 +78,13 @@ export function bindProductionAuth(ctx: BindProductionContext): void {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignInUseCase,
     factory: signInUseCase,
-    deps: [repo, authService],
+    deps: [repo, authService, ctx.rateLimit ?? new NoopRateLimit()],
     feature: "auth",
     layer: "use-case",
     name: "signIn",
     tracer,
     logger,
+    rateLimit: ctx.rateLimit ?? new NoopRateLimit(),
   });
   const wrappedSignUp = wireUseCase({
     container: authContainer,

packages/auth/src/di/bind-production.types.test.ts

@@ -19,7 +19,8 @@ describe("auth.signIn binding slot (type-level)", () => {
     // It returns a function with no brand attached — must not be assignable.
     const fakeRepo = {} as never;
     const fakeAuth = {} as never;
-    const unwrapped = signInUseCase(fakeRepo, fakeAuth);
+    const fakeRateLimit = {} as never;
+    const unwrapped = signInUseCase(fakeRepo, fakeAuth, fakeRateLimit);
 
     // @ts-expect-error — unwrapped factory has no __instrumented / __captured brand
     const _bad: Slot = unwrapped;

packages/auth/src/di/module.ts

@@ -1,5 +1,6 @@
 import { ContainerModule, type interfaces } from "inversify";
 
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import type { IUsersRepository } from "../application/repositories/users.repository.interface";
 import type { IAuthenticationService } from "../application/services/authentication.service.interface";
 import { MockUsersRepository } from "../infrastructure/repositories/users.repository.mock";
@@ -42,6 +43,7 @@ export const AuthModule = new ContainerModule((bind: interfaces.Bind) => {
       ctx.container.get<IAuthenticationService>(
         AUTH_SYMBOLS.IAuthenticationService,
       ),
+      new NoopRateLimit(),
     ),
   );