The new API endpoints are working great, but we should add rate limiting before launch.

Here's a quick example: `typescript const limiter = rateLimit({ windowMs: 15 60 1000, max: 100 }); `

See the rate limiting docs for details.

Tested the authentication flow and found these issues:

• Login with invalid credentials shows a generic error
• Session timeout is too aggressive (5 min)
• refresh_token endpoint returns 500 on edge cases