feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-eslint/rules/_manifest-ast.js

@@ -7,6 +7,31 @@ function extractStringLiterals(arrayExpr) {
     .map((el) => el.value);
 }
 
+/**
+ * Extract budget names from a rateLimit array that contains either string
+ * literals ("ip") or RateLimitBudget objects ({ name: "ip", window: "1m", budget: 5 }).
+ */
+function extractRateLimitNames(arrayExpr) {
+  const names = [];
+  for (const el of arrayExpr.elements) {
+    if (!el) continue;
+    if (el.type === "Literal" && typeof el.value === "string") {
+      names.push(el.value);
+    } else if (el.type === "ObjectExpression") {
+      const nameProp = el.properties.find(
+        (p) =>
+          p.type === "Property" &&
+          p.key.type === "Identifier" &&
+          p.key.name === "name" &&
+          p.value.type === "Literal" &&
+          typeof p.value.value === "string",
+      );
+      if (nameProp) names.push(nameProp.value.value);
+    }
+  }
+  return names;
+}
+
 /**
  * Parse a feature.manifest.ts file and extract per-use-case attributes.
  * Walks the AST to find the `defineFeature({...} as const)` call expression
@@ -98,11 +123,12 @@ function extractUseCaseEntry(objExpr) {
       (key === "audits" ||
         key === "publishes" ||
         key === "consumes" ||
-        key === "analyticsEvents" ||
-        key === "rateLimit") &&
+        key === "analyticsEvents") &&
       prop.value.type === "ArrayExpression"
     ) {
       entry[key] = extractStringLiterals(prop.value);
+    } else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
+      entry[key] = extractRateLimitNames(prop.value);
     }
   }
   return entry;
@@ -232,11 +258,12 @@ function extractUseCaseEntryFromObj(objExpr) {
       (key === "audits" ||
         key === "publishes" ||
         key === "consumes" ||
-        key === "analyticsEvents" ||
-        key === "rateLimit") &&
+        key === "analyticsEvents") &&
       prop.value.type === "ArrayExpression"
     ) {
       entry[key] = extractStringLiterals(prop.value);
+    } else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
+      entry[key] = extractRateLimitNames(prop.value);
     }
   }
   return entry;

packages/core-eslint/rules/no-undeclared-rate-limit.test.js

@@ -110,6 +110,50 @@ describe("no-undeclared-rate-limit", () => {
     });
   });
 
+  it("passes when rateLimit.consume budget matches a RateLimitBudget object in manifest rateLimit[]", () => {
+    const repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nurl-obj-"));
+    const featureDir = path.join(repoRoot, "packages", "demo");
+    fs.mkdirSync(path.join(featureDir, "src", "application", "use-cases"), {
+      recursive: true,
+    });
+    fs.writeFileSync(
+      path.join(featureDir, "src", "feature.manifest.ts"),
+      `export const demoManifest = defineFeature({
+  name: "demo",
+  requiredCores: [],
+  useCases: {
+    signUp: { mutates: true, audits: [], publishes: [], consumes: [], rateLimit: [{ name: "ip", window: "1m", budget: 5 }, { name: "account", window: "1h", budget: 10 }] },
+  },
+  realtimeChannels: [],
+  jobs: [],
+} as const);`,
+    );
+    const useCaseFile = path.join(
+      featureDir,
+      "src",
+      "application",
+      "use-cases",
+      "sign-up.use-case.ts",
+    );
+    fs.writeFileSync(
+      useCaseFile,
+      `export const signUpUseCase = (rateLimit) => async (input) => {
+  await rateLimit.consume("ip", input.clientIp);
+  await rateLimit.consume("account", input.username);
+};`,
+    );
+    tester.run("no-undeclared-rate-limit", rule, {
+      valid: [
+        {
+          filename: useCaseFile,
+          code: fs.readFileSync(useCaseFile, "utf8"),
+          options: [{ repoRoot }],
+        },
+      ],
+      invalid: [],
+    });
+  });
+
   it("is a no-op for non-use-case files", () => {
     const { repoRoot } = makeFixture({
       manifestRateLimit: ["signUp.ip"],