feat: Add login rate limiter middleware for brute-force protection

[Suyash-ka-github]

Summary

• Adds Redis-backed rate limiter on login (5 attempts / 60s window, 10min cooldown)
• Normalizes emails to lowercase at signup, OTP, forgot-password, and login
• Closes rate-limiter bypass when password field is omitted
• Uses atomic Lua increment+expire, generic error responses, and hashed log identifiers

[Copilot]

Pull request overview

Adds Redis-backed brute-force protection to the /login endpoint by introducing a login rate-limiter middleware and wiring it into the user login flow.

Changes:

• Added loginRateLimiter middleware to block login requests after too many failed attempts per IP.
• Added controller hooks to increment failed-attempt counters and clear them on successful login.
• Introduced a new middleware module to manage Redis-backed attempt tracking.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
src/routes/userRoutes.ts	Adds loginRateLimiter to the /login route middleware chain.
src/middleware/rateLimiter.ts	Implements Redis-backed rate limiting with per-IP tracking and lockout behavior.
src/controllers/userController.ts	Increments failed-attempt counters on login failure paths and clears them on success.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.