Add rate limiting to send-verification-email endpoint

Issue

BetterAuth's /api/auth/send-verification-email endpoint has no rate limiting. An attacker can repeatedly call it with a known registered email address to flood the target's inbox with verification emails.

BetterAuth does implement timing-safe behavior (creates a token even for non-existent emails to prevent timing-based enumeration), but does not throttle repeated requests.

Impact

Low severity. The attacker cannot gain access to the account or intercept the verification token — emails are sent to the actual owner's inbox. The risk is inbox spam/harassment.

Options

1. Rate limit at nginx — limit POST requests to /api/auth/send-verification-email per IP (e.g., 3 per 15 minutes)
2. Rate limit in app — track send attempts per email address and reject after threshold
3. Check BetterAuth's rateLimit config — BetterAuth may support built-in rate limiting for this endpoint