Rate-limit the password change endpoint (#65)

The password change POST verifies the current password, making it
a password-based authentication endpoint that REPO_POLICIES.md
requires rate limiting on. Extract the login limiter's POST-only
per-IP pattern into a shared postRateLimit helper and apply the
same 5-per-minute limit to POST /user/{username}/password.

internal/server/routes.go

@@ -110,7 +110,9 @@ func (s *Server) setupUserRoutes() {
 		r.Use(s.mw.NoCache())
 		r.Use(s.mw.RequireAuth())
 		r.Get("/", s.h.HandleProfile())
-		r.Post("/password", s.h.HandlePasswordChange())
+		r.With(s.mw.PasswordChangeRateLimit()).Post(
+			"/password", s.h.HandlePasswordChange(),
+		)
 	})
 }