fix(06): WR-01 reset auth_limiter between tests to prevent 429 cross-contamination

Add auth_limiter (IP-level limiter from api.auth) to the reset_rate_limiter
autouse fixture in conftest.py, alongside the existing account_limiter reset.
Prevents spurious 429s when tests call /api/auth/* endpoints in a tight loop.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/tests/conftest.py

@@ -161,14 +161,17 @@ async def async_client(db_session: AsyncSession):
 def reset_rate_limiter():
     """Reset the in-memory rate limiter storage before each test.
 
-    The account_limiter is a module-level singleton using MemoryStorage.
-    Without this fixture, rate limit counters accumulate across tests in the
-    same process and cause unrelated tests to receive 429 responses.
+    Resets both account_limiter (per-user) and auth_limiter (IP-level) so
+    that tight test loops against /api/auth/* do not accumulate counters and
+    cause spurious 429 failures in later tests.
     """
     from services.rate_limiting import account_limiter
+    from api.auth import limiter as auth_limiter
     account_limiter._storage.reset()
+    auth_limiter._storage.reset()
     yield
     account_limiter._storage.reset()
+    auth_limiter._storage.reset()
 
 
 # ── File fixtures ─────────────────────────────────────────────────────────────