Feat: Ajustes de seguridad

Backend/MotoresArgentinosV2.API/Controllers/AuthController.cs

@@ -11,7 +11,7 @@ namespace MotoresArgentinosV2.API.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
-// CORRECCIÓN: Se quitó [EnableRateLimiting("AuthPolicy")] de aquí para no bloquear /me ni /logout
+[EnableRateLimiting("AuthPolicy")]
 public class AuthController : ControllerBase
 {
     private readonly IIdentityService _identityService;
@@ -33,7 +33,7 @@ public class AuthController : ControllerBase
         var cookieOptions = new CookieOptions
         {
             HttpOnly = true, // Seguridad: JS no puede leer esto
-            Expires = DateTime.UtcNow.AddDays(7),
+            Expires = DateTime.UtcNow.AddMinutes(15),
             Secure = true, // Solo HTTPS (localhost con https cuenta)
             SameSite = SameSiteMode.Strict,
             IsEssential = true