Fix Critical Security Issue: Implement rate limiting on API endpoints

Added comprehensive rate limiting to prevent abuse and DoS attacks:

Configuration (config/settings/base.py):
- Anon rate: 100 requests/hour for anonymous users
- User rate: 1000 requests/hour for authenticated users
- Login rate: 10 attempts/hour (prevents brute force)
- Register rate: 5 attempts/hour (prevents account spam)
- Sync rate: 100 requests/hour (prevents sync flooding)

Custom throttle classes (users/throttles.py):
- LoginRateThrottle: Strict limit for login endpoint
- RegisterRateThrottle: Strict limit for registration endpoint
- SyncRateThrottle: Moderate limit for sync endpoint

Applied throttling to sensitive endpoints:
- users.views.RegisterAPIView: 5/hour
- users.views.TokenObtainPairView: 10/hour
- sync.views.sync: 100/hour

All other API endpoints use default throttles (anon: 100/hour, user: 1000/hour).

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

users/views.py

@@ -21,6 +21,7 @@ from .serializers import (
     DeviceTokenSerializer,
 )
 from .models import DeviceToken, EmailVerificationToken
+from .throttles import LoginRateThrottle, RegisterRateThrottle
 
 User = get_user_model()
 
@@ -35,6 +36,7 @@ class RegisterAPIView(generics.CreateAPIView):
     queryset = User.objects.all()
     serializer_class = UserRegistrationSerializer
     permission_classes = [permissions.AllowAny]
+    throttle_classes = [RegisterRateThrottle]
 
     def create(self, request, *args, **kwargs):
         serializer = self.get_serializer(data=request.data)
@@ -225,6 +227,7 @@ class TokenObtainPairView(BaseTokenObtainPairView):
     """Custom JWT token view using our custom serializer."""
 
     serializer_class = CustomTokenObtainPairSerializer
+    throttle_classes = [LoginRateThrottle]
 
 
 # =============================================================================