feat(account): throttle confirm-code sends per recipient

Add an in-memory SendLimiter enforcing a one-per-minute cooldown and a
five-per-rolling-hour cap per recipient address, checked before provisioning or
sending in RequestCode, RequestLoginCode and RequestLinkCode. It guards against
email bombing and protects the relay quota. The limiter is injected in main
(nil in tests, so the domain suite is unaffected); ErrTooManyRequests maps to
HTTP 429.

backend/internal/server/dto_test.go

@@ -30,6 +30,7 @@ func TestStatusForError(t *testing.T) {
 		"illegal play":   {engine.ErrIllegalPlay, http.StatusUnprocessableEntity, "illegal_play"},
 		"email taken":    {account.ErrEmailTaken, http.StatusConflict, "email_taken"},
 		"code mismatch":  {account.ErrCodeMismatch, http.StatusUnauthorized, "code_invalid"},
+		"too many codes": {account.ErrTooManyRequests, http.StatusTooManyRequests, "too_many_requests"},
 		"session gone":   {session.ErrNotFound, http.StatusUnauthorized, "session_invalid"},
 		"chat forbidden": {social.ErrForbiddenContent, http.StatusUnprocessableEntity, "chat_rejected"},
 		"no hint move":   {game.ErrNoHintAvailable, http.StatusConflict, "no_hint_available"},