feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/auth/src/di/bind-dev-seed.ts

@@ -10,6 +10,7 @@ import {
   assertFeatureConformance,
   wireUseCase,
 } from "@repo/core-shared/conformance";
+import { NoopRateLimit } from "@repo/core-shared/rate-limit";
 import { authManifest } from "../feature.manifest.js";
 import { authContainer } from "./container.js";
 import { AUTH_SYMBOLS } from "./symbols.js";
@@ -85,12 +86,13 @@ export async function bindDevSeedAuth(ctx: BindContext): Promise<void> {
     container: authContainer,
     symbol: AUTH_SYMBOLS.ISignInUseCase,
     factory: signInUseCase,
-    deps: [repo, authService],
+    deps: [repo, authService, ctx.rateLimit ?? new NoopRateLimit()],
     feature: "auth",
     layer: "use-case",
     name: "signIn",
     tracer,
     logger,
+    rateLimit: ctx.rateLimit ?? new NoopRateLimit(),
   });
   const wrappedSignUp = wireUseCase({
     container: authContainer,