Add unit test for injectAuthRateLimiter

[adnaan]

Context

This follow-up task was identified during the review of PR #248.

Source PR: #248
PR Title: feat: add per-IP rate limiting for global and auth endpoints
Suggested by: @claude[bot] (multiple reviews)

Task Description

injectAuthRateLimiter is the most complex injection logic in the auth generator — regex-based string surgery with an idempotency check and prerequisite detection. Currently only covered indirectly by TestGeneratedAppFullFlow.

Add focused unit tests with known main.go fixtures covering:

• Normal injection (authRL declaration inserted before first auth handler call)
• Idempotency (calling twice doesn't double-inject)
• Pre-rate-limiting apps (skips injection when newRateLimiter not present)
• Partial route injection (some routes fail, authRL still injected for successful ones)

Original Comment

No unit tests for injectAuthRateLimiter. This is the most complex injection logic in the PR — regex matching, string splicing, idempotency check. A focused unit test with a known main.go fixture would catch regressions much more precisely than the integration test alone. — @claude[bot]