Proposal: Add 60-second rate limiting to send-otp function

Hey everyone! While I was looking through the send-otp function in functions/send-otp/src/main.js, I noticed there isn't really anything stopping someone from hitting the endpoint repeatedly. This could lead to "OTP bombing" or just waste our API credits pretty quickly.

I’d like to add a 60-second cooldown logic. Basically, the function would check a last_otp_sent timestamp in the database before sending a new one, and return a 429 error if it’s too soon.

I've contributed to the Resonate-Website before and I'm planning to participate in GSoC 2026, so I'd love to help out on the backend side of things now. I've already forked the repo and have a good idea of how to implement this.

@M4dhav, could you please assign this to me so I can get a PR ready?