feat: authLimiter on POST /login, GET /callback, POST /dev-login (10 req / 5 min)

server.js

@@ -27,7 +27,7 @@ const { initAuth, requireAdmin } = require('./src/auth');
 const { aggregateCIDRs }   = require('./src/validators');
 const q                    = require('./src/queries');
 const { MOCK_USERS, backUrl } = require('./src/config');
-const { mutationLimiter, exportLimiter } = require('./src/middleware/rateLimit');
+const { mutationLimiter, exportLimiter, authLimiter } = require('./src/middleware/rateLimit');
 const { initCsrf }         = require('./src/middleware/csrf');
 const { createSessionMiddleware } = require('./src/middleware/session');
 const { CSP_DIRECTIVES }   = require('./src/middleware/csp');
@@ -97,6 +97,7 @@ async function start() {
     doubleCsrfProtection,
     generateCsrfToken,
     MOCK_USERS,
+    authLimiter,
   }));
 
   // ── Все маршруты ниже требуют авторизации (auth.middleware) ────────────────