Password auth

Registration is POST .../records on an auth collection with password/passwordConfirm. Signing in is POST .../auth-with-password with an identity (not necessarily an email — whatever authOptions.identityField names) and password. AUTH_RATE_LIMIT_ENABLED (on by default) rate-limits auth-with-password and the request-*/confirm-* email/OTP flows per client IP; auth-refresh is deliberately excluded from that limit.