feat(auth): add signIn rate-limit backfill with dual ip/account budgets

Wires the rate-limit primitive end-to-end through auth.signIn as the
canonical credential-stuffing defence example:

- manifest: rateLimit [ip 5/1m, account 10/1h] on signIn use case
- use case: rateLimit: IRateLimit dep; dual consume + TooManyRequestsError
- binders: ctx.rateLimit ?? new NoopRateLimit() in bind-production + bind-dev-seed
- tRPC: TooManyRequestsError → TOO_MANY_REQUESTS error code in authProcedure
- tests: RecordingRateLimit dual-consume assertion; InMemoryRateLimit
  budget-1 ip + account rejection; coverage 100% on use-cases layer
- ESLint: _manifest-ast.js extractRateLimitNames handles RateLimitBudget
  objects ({name,window,budget}) in addition to plain string literals,
  no-undeclared-rate-limit passes on both "ip" and "account" call sites

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/core-eslint/rules/no-undeclared-rate-limit.test.js

@@ -110,6 +110,50 @@ describe("no-undeclared-rate-limit", () => {
     });
   });
 
+  it("passes when rateLimit.consume budget matches a RateLimitBudget object in manifest rateLimit[]", () => {
+    const repoRoot = fs.mkdtempSync(path.join(os.tmpdir(), "nurl-obj-"));
+    const featureDir = path.join(repoRoot, "packages", "demo");
+    fs.mkdirSync(path.join(featureDir, "src", "application", "use-cases"), {
+      recursive: true,
+    });
+    fs.writeFileSync(
+      path.join(featureDir, "src", "feature.manifest.ts"),
+      `export const demoManifest = defineFeature({
+  name: "demo",
+  requiredCores: [],
+  useCases: {
+    signUp: { mutates: true, audits: [], publishes: [], consumes: [], rateLimit: [{ name: "ip", window: "1m", budget: 5 }, { name: "account", window: "1h", budget: 10 }] },
+  },
+  realtimeChannels: [],
+  jobs: [],
+} as const);`,
+    );
+    const useCaseFile = path.join(
+      featureDir,
+      "src",
+      "application",
+      "use-cases",
+      "sign-up.use-case.ts",
+    );
+    fs.writeFileSync(
+      useCaseFile,
+      `export const signUpUseCase = (rateLimit) => async (input) => {
+  await rateLimit.consume("ip", input.clientIp);
+  await rateLimit.consume("account", input.username);
+};`,
+    );
+    tester.run("no-undeclared-rate-limit", rule, {
+      valid: [
+        {
+          filename: useCaseFile,
+          code: fs.readFileSync(useCaseFile, "utf8"),
+          options: [{ repoRoot }],
+        },
+      ],
+      invalid: [],
+    });
+  });
+
   it("is a no-op for non-use-case files", () => {
     const { repoRoot } = makeFixture({
       manifestRateLimit: ["signUp.ip"],