security: rate-limit /auth/refresh

Refresh is unauthenticated (expired/absent access token) and rotates sessions
but had no rate limiter, so a stolen refresh token could be hammered. Add a
per-IP limiter (login thresholds, own bucket), matching login/register.

NOTE: full refresh-token reuse detection (revoke the session family when an
already-rotated token is presented) is deferred — it needs a session-family
tombstone migration + raw-pgx repo changes on the auth hot path, which warrant
integration testing against a real DB. Token-at-rest hashing (done) already
removes the DB-leak theft vector.

Author: Fr1ngg

internal/gateway/router.go

@@ -155,6 +155,13 @@ func NewRouter(p RouterParams) http.Handler {
 		p.AuthRateLimiters.LoginCfg,
 		"register",
 	)
+	// Refresh is unauthenticated (the access token is expired/absent) and rotates
+	// sessions; throttle per-IP so a stolen refresh token can't be hammered.
+	refreshRL := middleware.AuthRateLimit(
+		p.AuthRateLimiters.Login,
+		p.AuthRateLimiters.LoginCfg,
+		"refresh",
+	)
 	acceptInviteRL := middleware.AuthRateLimit(
 		p.AuthRateLimiters.AcceptInvitation,
 		p.AuthRateLimiters.AcceptInvitationCfg,
@@ -173,7 +180,7 @@ func NewRouter(p RouterParams) http.Handler {
 		api.With(registerRL).Post("/auth/register", p.IdentityHandler.Register)
 		api.With(loginRL).Post("/auth/login", p.IdentityHandler.Login)
 		api.Post("/auth/verify-email", p.IdentityHandler.VerifyEmail)
-		api.Post("/auth/refresh", p.IdentityHandler.RefreshToken)
+		api.With(refreshRL).Post("/auth/refresh", p.IdentityHandler.RefreshToken)
 
 		// Public webhook endpoints (authenticated by their respective handlers).
 		api.Post("/webhooks/remnawave", p.WebhookHandler.ServeHTTP)