Mobile auth: native login + register via central identity API.

Login no longer uses the OAuth password grant (which wasn't enabled, the cause
of login failures). Both login and the new register endpoint proxy to
auth.ladill.com /api/identity/auth/* (shared IDENTITY_API_KEY_MINI), provision
the local mirror, and issue a Sanctum token — one Ladill identity across web
and app.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/api.php

@@ -10,8 +10,10 @@ use App\Http\Controllers\Api\QrCodeController;
 use Illuminate\Support\Facades\Route;
 
 Route::prefix('v1')->group(function () {
-    // Mobile token login (Ladill Mini Android). Public — issues a Sanctum token.
-    Route::post('/auth/login', [AuthController::class, 'login'])->name('api.auth.login');
+    // Mobile token auth (Ladill Mini Android). Public — proxies to the central
+    // Ladill identity API and issues a Sanctum token.
+    Route::post('/auth/login', [AuthController::class, 'login'])->middleware('throttle:10,1')->name('api.auth.login');
+    Route::post('/auth/register', [AuthController::class, 'register'])->middleware('throttle:10,1')->name('api.auth.register');
 
     Route::middleware(['auth:sanctum', \App\Http\Middleware\SetActingAccount::class])->group(function () {
         Route::post('/auth/logout', [AuthController::class, 'logout'])->name('api.auth.logout');