feat(auth): #68: add in-memory rate limiting for register, login, and reset

[imdeepmind]

Implements #68.

Summary

Adds an in-memory rate limiter (internal/platform/ratelimit) that locks a username out for 5 minutes after 5 consecutive failed attempts. Applied independently to register, login, and reset (each has its own quota), keyed by username.

Changes

• internal/platform/ratelimit/ratelimit.go (new): mutex-guarded Limiter with Check (returns remaining lockout), RecordFailure (locks at threshold), Reset. Lockout expiry starts a fresh window; entries never locked are left to accumulate.
• internal/features/auth/service.go: three independent limiters wired into Register, Login, ResetPassword. Check runs before any Argon2 work (blocked users never burn CPU); failures are counted only for genuine credential/identity errors; success resets the counter. Lockout error wraps ErrTooManyAttempts with the live countdown.
• internal/shared/errors/errors.go: new ErrTooManyAttempts sentinel; moved ErrInvalidSecret here from crypto as an internal marker.
• internal/shared/crypto/encryption.go: DecryptData wraps AES-GCM auth failures with ErrInvalidSecret.

Fixes along the way

• Wrong password on login previously surfaced as the generic internal error (cipher: message authentication failed from the keyring credential decrypt). Now mapped to ErrInvalidPassword (invalid username or password), and it counts toward the login lockout.
• Two bugs in the limiter that prevented it from ever locking: RecordFailure reset the count on every failure (zero-value lockedUntil treated as expired), and Check deleted entries that had never tripped a lockout. Both fixed and verified.

No test scripts added (no Go tests in the repo).