Add scoped throttling for public auth endpoints

[TThanos3000]

Adds POST-only scoped DRF throttling for public auth/email and external registration endpoints based on docs/api-safety-audit.md.

Scope:

• POST /auth/users/
• POST /auth/resend_email/
• POST /auth/reset_password/
• POST /api/token/
• POST /programs//register_new/

No serializers, payload shapes, business validation branches, GitHub Actions, deploy, nginx, dev branch, or release config changed.

Checks:

• git diff --check passed
• py_compile passed for changed helper/test files
• targeted Django tests blocked locally by missing dependency decouple
• flake8 unavailable in environment