Add rate limiting to auth, public share pages and metadata fetching

Tier 2 — security

Problem

Nothing in the app is throttled. In particular:

• Login and registration accept unlimited attempts (Identity lockout helps, but only per-account).
• /shared/{token} is anonymous and unthrottled, so share tokens can be brute-forced and the page is a free amplification target (it loads full resource rows including thumbnails).
• The metadata fetcher lets any authenticated user make the server issue arbitrary outbound HTTP requests on demand, with no per-user budget.

Evidence

• No AddRateLimiter anywhere in the repository
• LearnStack/Components/Pages/SharedView.razor:4 — [AllowAnonymous]
• LearnStack.Core/Extensions/ServiceCollectionExtensions.cs:29-34 — unthrottled HttpClient

Proposed fix

1. builder.Services.AddRateLimiter(...) with a fixed window on /Account/*.
2. A per-IP window on /shared/{token} and /friends/accept/{token}.
3. A per-user concurrency limiter around OpenGraph fetches.

Acceptance criteria

• Repeated login attempts from one IP are throttled with 429
• Share-token enumeration is rate-limited
• One user cannot saturate the outbound HTTP client

Start with LearnStack/Components/Pages/SharedView.razor:4 and LearnStack.Core/Extensions/ServiceCollectionExtensions.cs:29-34, then trace the /Account/*, /shared/{token}, /friends/accept/{token}, and OpenGraph fetch entry points. Done means repeated login attempts return 429, share-token enumeration is throttled, and one user cannot saturate outbound HTTP requests.