feat(auth): OpenAPI docs, input sanitization, password refactor, retry with backoff

[demilade18-git]

• Document AuthAPI with OpenAPI specs #1339: @ApiOperation/@apiresponse on the main AuthController operations; docs/api/auth-openapi.md
• Add input sanitization to AuthAPI #1340: class-transformer sanitisation of email and name fields in RegisterDto/LoginDto (NFKC, control chars, HTML tags; case and passwords untouched); docs/api/auth-input-sanitization.md
• Refactor AuthAPI to reduce complexity #1341: changePassword/resetPassword share assertPasswordMeetsPolicy, assertPasswordNotReused and recordPasswordHistory helpers; behaviour unchanged; docs/api/auth-refactor.md
• Add retry with backoff to AuthAPI #1342: retryWithBackoff util applied to the reCAPTCHA request and the password reset email; docs/api/auth-retry.md

Scope kept minimal: small module-local additions plus a short doc under docs/api/ per issue. Each issue's tests are not added unless the issue is itself about tests; nothing was run. The refactor is behaviour-preserving but unverified (not compiled or tested). Other Auth API PRs in this batch also edit auth.controller.ts and auth.service.ts, so expect trivial merge conflicts.

Nothing was installed, built or run (no tsc, lint or jest); please verify in CI/review.

Closes #1339
Closes #1340
Closes #1341
Closes #1342

[drips-wave]

@demilade18-git Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[nanaf6203-bit]

resolve conflicts @demilade18-git