fix: harden booking and meeting flows

lib/auth/verificationRateLimit.ts

@@ -0,0 +1,9 @@
+import { checkRateLimit, getClientIp } from "./rateLimit";
+
+/** Shared budgets for registration, email changes and resend (REST and GraphQL). */
+export function allowVerificationEmail(request: { headers: Headers }, email: string, customerId?: string | number): boolean {
+  const windowMs = 60 * 60 * 1000;
+  return checkRateLimit(`verification:ip:${getClientIp(request)}`, { max: 10, windowMs }) &&
+    (customerId === undefined || checkRateLimit(`verification:customer:${customerId}`, { max: 3, windowMs })) &&
+    checkRateLimit(`verification:email:${email.trim().toLowerCase()}`, { max: 3, windowMs });
+}