/api/auth/reset has no rate limit

**Severity:** Low Unlike login/forgot/verify, the reset-consume endpoint (`src/app/api/auth/reset/route.ts`) calls `resetPassword` with no `enforceRateLimits`. The token is 256-bit and hashed at rest so online guessing is infeasible, but a per-IP limit is good defense-in-depth and bounds the PBKDF2 work each call triggers. **Fix** Add a per-IP rate limit mirroring the other auth routes (copy the pattern from `login`/`forgot`). **Acceptance:** repeated reset calls from one IP get `429` past the threshold.