fix(auth): harden sensitive authenticated routes

[CubityFirst]

Summary

• add per-user rate limiting to sensitive authenticated routes and direct-IP limiting to OIDC userinfo
• require current-password reauthentication for account deletion, including the settings UI and 2FA flow
• re-check account moderation before consuming force-change-password tokens
• add fail-closed regression coverage for rate limiting, moderation, and OAuth response semantics

Validation

• pnpm --filter auth test — 47 files / 371 tests passed
• pnpm --filter auth typecheck — passed
• pnpm --filter @annex/frontend test — 67 files / 822 tests passed
• pnpm --filter @annex/frontend build — passed (existing chunk-size warnings only)
• pnpm --filter cubedocs-e2e exec playwright test tests/2fa.spec.ts --list — 28 tests discovered successfully; live E2E execution requires the development stack