DO-NOT-AUTO-MERGE: Rate-limit public auth endpoints

[berntpopp]

Summary

• extract the hardened S6 caller-fingerprint/sliding-window implementation into a reusable bounded primitive
• protect signup, authenticate, and password-reset request with independent fail-closed auth policy and 429/Retry-After
• prevent auth credentials from entering normal or exception logs, including malformed unnamed JSON
• preserve rightmost-untrusted XFF resolution, Traefik alias stripping, mount_endpoint(), and problem+json behavior

Verification

• TDD RED→GREEN: N+1, independent clients, spoofed XFF, malformed config/CIDRs/decisions, retry-after, parser order, strict JSON shapes, bounded overflow, normal logging, exception logging
• make test-api-fast: 6344 pass, 0 fail, 314 classified skips
• make lint-api: 175 files, 0 findings
• make code-quality-audit
• base + Playwright Compose render
• live Traefik proof: client A 400/400/429 with Retry-After: 60; network-distinct client B remained non-429
• xhigh Codex review: 6 rounds; final APPROVE, no BLOCKER/HIGH

Closes #550
Refs #535