feat: add Retry-After header and countdown timer for rate limits

- Rate limiter returns retryAfterSec in response body + Retry-After header
- Registration rate limits: 10 per 10min (was 15/hour)
- Frontend surfaces retry timer in error messages

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/middleware/rate-limit.ts

@@ -38,7 +38,9 @@ export function rateLimit(windowMs: number, maxHits: number) {
     } else {
       entry.count++
       if (entry.count > maxHits) {
-        return c.json({ error: 'Too many requests. Slow down.' }, 429)
+        const retryAfterSec = Math.ceil((entry.resetAt - now) / 1000)
+        c.header('Retry-After', String(retryAfterSec))
+        return c.json({ error: 'Too many requests. Slow down.', retryAfterSec }, 429)
       }
     }