feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-eslint/rules/_manifest-ast.js

@@ -7,6 +7,31 @@ function extractStringLiterals(arrayExpr) {
     .map((el) => el.value);
 }
 
+/**
+ * Extract budget names from a rateLimit array that contains either string
+ * literals ("ip") or RateLimitBudget objects ({ name: "ip", window: "1m", budget: 5 }).
+ */
+function extractRateLimitNames(arrayExpr) {
+  const names = [];
+  for (const el of arrayExpr.elements) {
+    if (!el) continue;
+    if (el.type === "Literal" && typeof el.value === "string") {
+      names.push(el.value);
+    } else if (el.type === "ObjectExpression") {
+      const nameProp = el.properties.find(
+        (p) =>
+          p.type === "Property" &&
+          p.key.type === "Identifier" &&
+          p.key.name === "name" &&
+          p.value.type === "Literal" &&
+          typeof p.value.value === "string",
+      );
+      if (nameProp) names.push(nameProp.value.value);
+    }
+  }
+  return names;
+}
+
 /**
  * Parse a feature.manifest.ts file and extract per-use-case attributes.
  * Walks the AST to find the `defineFeature({...} as const)` call expression
@@ -98,11 +123,12 @@ function extractUseCaseEntry(objExpr) {
       (key === "audits" ||
         key === "publishes" ||
         key === "consumes" ||
-        key === "analyticsEvents" ||
-        key === "rateLimit") &&
+        key === "analyticsEvents") &&
       prop.value.type === "ArrayExpression"
     ) {
       entry[key] = extractStringLiterals(prop.value);
+    } else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
+      entry[key] = extractRateLimitNames(prop.value);
     }
   }
   return entry;
@@ -232,11 +258,12 @@ function extractUseCaseEntryFromObj(objExpr) {
       (key === "audits" ||
         key === "publishes" ||
         key === "consumes" ||
-        key === "analyticsEvents" ||
-        key === "rateLimit") &&
+        key === "analyticsEvents") &&
       prop.value.type === "ArrayExpression"
     ) {
       entry[key] = extractStringLiterals(prop.value);
+    } else if (key === "rateLimit" && prop.value.type === "ArrayExpression") {
+      entry[key] = extractRateLimitNames(prop.value);
     }
   }
   return entry;