Add rate limiting to login endpoint to prevent brute force

Apply per-IP rate limiting (5 attempts/minute) to POST /login using
golang.org/x/time/rate. Returns 429 Too Many Requests when exceeded.

Closes #12

internal/server/routes.go

@@ -39,7 +39,7 @@ func (s *Server) SetupRoutes() {
 
 	// Public routes
 	s.router.Get("/login", s.handlers.HandleLoginGET())
-	s.router.Post("/login", s.handlers.HandleLoginPOST())
+	s.router.With(s.mw.LoginRateLimit()).Post("/login", s.handlers.HandleLoginPOST())
 	s.router.Get("/setup", s.handlers.HandleSetupGET())
 	s.router.Post("/setup", s.handlers.HandleSetupPOST())