* fix(auth): enhance password validation and rate limiting for login attempts
- Added password length validation to prevent CPU DoS attacks, limiting to 128 characters.
- Implemented constant-time password verification to mitigate timing attacks.
- Adjusted rate limit for login attempts from 30 to 10 per 15 minutes for improved security.
- Updated login form validation to reflect new password length constraints.
- Introduced constants for authentication endpoints in the API.
* fixed sample size for timing test
* password validation messages
---------
Co-authored-by: Your Name <you@example.com>
