Rate-limit signups per IP

What you'll learn

Implementing and testing a sliding-window rate limiter

Acceptance criteria

• More than 5 signups from one IP within 10 minutes returns 429
• The 429 response includes a Retry-After header in seconds
• The limiter is its own module with the limit and window configurable (so tests can use a short window)
• Memory does not grow forever: old entries are cleaned up
• Tests cover under the limit, over the limit and the window resetting

Contribution rules

• Work on a branch named task-6-…
• Your PR description must include Closes #6
• Open the PR from the GitHub account you signed in with
• A maintainer must approve and merge it