fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

.env.example

@@ -10,3 +10,5 @@ PORT=8080
 DB_FILE=./data/renewcms.db
 UPLOAD_DIR=./data/uploads
 CORS_ALLOWED_ORIGINS=
+AUTH_RATE_LIMIT_MAX_ATTEMPTS=5
+AUTH_RATE_LIMIT_WINDOW_SECONDS=60