feat(auth): harden registration security defaults

[capybaracplusplus]

Summary

• add an atomic PostgreSQL-backed per-IP sign-up rate limit with a configurable 15-minute window and HTTP 429 contract
• require email verification before sign-in by default
• clear sensitive email outbox payloads when delivery reaches a terminal failure
• add migration, repository wiring, dynamic-config examples, documentation, unit tests, and concurrent functional coverage

Why

Registration was the remaining public authentication flow without a shared-store application limiter. Concurrent requests could therefore bypass any process-local control and trigger expensive password hashing. The previous verified-email default was also permissive, and terminal outbox rows retained verification or recovery material indefinitely.

The limiter now validates cheap input first, then atomically consumes a PostgreSQL slot before uniqueness queries and bcrypt. It stores only normalized IP and timestamp; edge limits remain required for malformed bodies and traffic bursts.

Behavior changes

• valid sign-up attempts above max_attempts_per_ip return 429 auth.sign_up.too_many_attempts
• sign_in.require_verified_email defaults to true, but remains dynamically configurable
• terminal email_outbox rows retain delivery metadata while replacing payload with {}
• migration 0012 creates sign_up_attempts

Validation

• Release build completed with production flags restored (testsuite, tests-control, and public ping disabled)
• Release unit tests passed
• full Release testsuite passed: unit plus 31 functional tests
• concurrent functional test verified exactly 2 accepted and 6 rejected sign-ups for an 8-request burst at a configured limit of 2
• changed C++ files pass clang-format --dry-run --Werror
• Python compilation, JSON/YAML parsing, and git diff --check pass

The local ARM devcontainer cannot finish the static Debug ASan/UBSan link within its 8 GB memory limit (ld is killed by the kernel). All Debug objects compile; the canonical Debug sanitizer job remains enabled in GitHub Actions.