Potential fix for code scanning alert no. 97: Missing rate limiting

[pphatdev]

Potential fix for https://github.com/pphatdev/api.sophat.top/security/code-scanning/97

To fix the missing rate limiting, we should add a rate-limiting middleware to the router. The best way is to use the well-known express-rate-limit package, which is designed for this purpose. We will import express-rate-limit, configure a rate limiter (e.g., 100 requests per 15 minutes per IP), and apply it to the router. Since we can only edit the code in src/routes/users.js, we will add the import, create the limiter, and use it as middleware before the protected routes. This ensures that all user-related endpoints are protected from abuse without changing their existing functionality.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.