[Rate] Rate limiting probes

[emmanuelgautier]

Description

Burst traffic probes against sensitive endpoints to confirm rate limiting is in place.

Checks to implement

• No HTTP 429 on burst to /login
• No HTTP 429 on burst to /reset-password
• No HTTP 429 on burst to /verify-otp
• Unbounded page size / no pagination limit

Tier rationale

Single-identity burst testing, no multi-user orchestration.