Throttle the token endpoint per account and address, not per address

POST /api/v1/auth/token was limited to 6 requests a minute per IP. The
deployed MCP server signs every user in from a single container, so
under a per-IP budget one person's mistyped password, or a stranger's
guesses, would lock every other user out of it.

The named `auth-token` limiter keys on the lower-cased username (or the
refresh token) plus the address, still 6 a minute, with a 30-a-minute
ceiling per address to bound how many accounts one client can try.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

public/openapi.yaml

@@ -909,8 +909,9 @@ paths:
       description: |
         Proxies the identity server's `password` and `refresh_token` grants so
         first-party clients need not embed the OAuth server's URL or secret.
-        Rate limited to 6 requests per minute. Browser clients should use
-        Authorization Code + PKCE instead.
+        Rate limited to 6 requests per minute per account and address, and 30
+        per address overall. Browser clients should use Authorization Code +
+        PKCE instead.
       security: []
       requestBody:
         required: true