Close captcha-bypass and email-abuse vectors

- Block direct /api/auth/sign-up at the middleware (404): it bypassed
  the Turnstile/honeypot wrapper. /api/register is unaffected — it
  invokes auth.handler programmatically, not through HTTP.
- Tighten rate limits on send-verification-email and forget-password
  (3/min/IP): both send emails to arbitrary addresses and shared the
  loose global 100/min limit.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/middleware.ts

@@ -6,6 +6,13 @@ const PUBLIC_ROUTES = ["/login", "/register", "/verify-email", "/forgot-password
 export function middleware(request: NextRequest) {
   const { pathname } = request.nextUrl;
 
+  // Прямой Better Auth sign-up обходит Turnstile/honeypot-обёртку
+  // (/api/register) — наружу закрыт. Сама регистрация не страдает:
+  // /api/register вызывает auth.handler программно, минуя middleware.
+  if (pathname.startsWith("/api/auth/sign-up")) {
+    return new NextResponse(null, { status: 404 });
+  }
+
   if (
     PUBLIC_ROUTES.some((route) => pathname.startsWith(route)) ||
     pathname.startsWith("/_next") ||