- Add verifyOtpLimiter: 5 attempts per 15 minutes per email/IP - Add requestOtpLimiter: 3 attempts per 15 minutes per email/IP - Use email as primary key, fallback to IP - Return JSON error messages for rate limit exceeded 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>