#41699 fix: forgot password email DDP method doesn't have strict rate limits

Proposed changes (including videos or screenshots)

The sendForgotPasswordEmail Meteor method (callable unauthenticated over DDP and method.callAnon) had no dedicated rate limit, relying only on the generic per-connection DDP limiter. This could be sidestepped by opening multiple connections or varying the anonymous connection ID, allowing password-reset emails to be triggered far faster than the REST users.forgotPassword endpoint permits.

Adds a DDPRateLimiter rule of 10 requests per 60 seconds per clientAddress, matching the REST endpoint's allowance. The limiter is keyed on clientAddress (rather than the always-null anonymous userId) so the limit is enforced per client instead of as a single global bucket.

Issue(s)

https://rocketchat.atlassian.net/browse/VLN-549

Steps to test or reproduce

Further comments

Summary by CodeRabbit

• Bug Fixes
  • Added per-client rate limiting to the “forgot password” email request, helping reduce abuse and improve service stability.
  • The password recovery flow now follows the same request limits as the related REST endpoint.