fix: login and password reset requests are rate-limited per client (not in the README; there is currently no brute-force protection on the public auth routes)

api/pkg/apperr/messages.go

@@ -13,3 +13,4 @@ const AlreadyVerifiedErrorMessage = "This account is already verified and cannot
 const VerificationRequiredErrorMessage = "You must verify your account to access this resource."
 const PasswordResetRequestedMessage = "If an account exists for that email, a password reset link has been sent."
 const PasswordResetFailedErrorMessage = "The password reset code is invalid or has expired."
+const TooManyRequestsErrorMessage = "Too many requests. Please try again later."