ENHANCEMENT: Add rate limiting on login and registration endpoints

[Senthil455]

Description

There is no rate limiting on the login or registration endpoints, leaving the application vulnerable to brute-force attacks, credential stuffing, and automated account creation.

Security Concerns

1. Login brute force - An attacker can try unlimited password combinations
2. Registration spam - Automated scripts can create hundreds of fake accounts
3. Denial of Service - Rapid repeated requests can overwhelm the server

Recommended Enhancement

1. Install Flask-Limiter:

   pip install flask-limiter
   

2. Configure rate limiting:

   from flask_limiter import Limiter
   from flask_limiter.util import get_remote_address
   
   limiter = Limiter(
       get_remote_address,
       app=app,
       default_limits=["200 per day", "50 per hour"]
   )

3. Apply strict limits to auth endpoints:

   @app.route('/login', methods=['GET', 'POST'])
   @limiter.limit("10 per minute")
   def login():
       ...
   
   @app.route('/register', methods=['GET', 'POST'])
   @limiter.limit("3 per hour")
   def register():
       ...

4. Implement account lockout after N failed attempts:

   # Track failed attempts in the database or cache
   # Lock account for 15 minutes after 5 failed attempts

5. Add CAPTCHA integration for registration to prevent automated signups