increase auth rate limit from 10 to 30 req/min

10 req/min was too restrictive, caused lockout on legitimate login attempts.

backend/cmd/api/main.go

@@ -131,7 +131,7 @@ func main() {
 		func(client *redis.Client, log *slog.Logger, fo bool) (rateLimiterInterface, error) {
 			return middleware.RateLimitAuthEndpoints(client, log, fo)
 		},
-		func() *middleware.RateLimiter { return middleware.NewRateLimiter(rate.Limit(10/60.0), 10) }, // 10 req/min
+		func() *middleware.RateLimiter { return middleware.NewRateLimiter(rate.Limit(30/60.0), 30) }, // 30 req/min
 	)
 	apiReadLimiter = newRateLimiterWithFallback(redisClient, redisAvailable, logger, failOpen,
 		func(client *redis.Client, log *slog.Logger, fo bool) (rateLimiterInterface, error) {

backend/internal/middleware/ratelimit_redis.go

@@ -125,7 +125,7 @@ func KeyByUserID(prefix string) func(*http.Request) string {
 
 func RateLimitAuthEndpoints(redisClient *redis.Client, logger *slog.Logger, failOpen bool) (*RedisRateLimiter, error) {
 	return NewRedisRateLimiter(redisClient, RateLimitConfig{
-		Rate:     limiter.Rate{Period: time.Minute, Limit: 10},
+		Rate:     limiter.Rate{Period: time.Minute, Limit: 30},
 		KeyFunc:  KeyByIP("auth"),
 		FailOpen: failOpen,
 		Logger:   logger,