chore: bump to v0.9.19-rc.1 and add local OpenAPI build support

- Add release candidate (rc) support to release.sh with latestRC tagging
- Bump VERSION, backend pyproject.toml, and frontend package.json to 0.9.19-rc.1
- Add local frontend/openapi.json so build no longer needs running backend
- Update generate:types and validate-types.sh to use local openapi.json
- Fix frontend tests: remove unused imports/variables and update mock data

frontend/src/types/generated.ts

@@ -177,11 +177,6 @@ export interface paths {
          *     On success the token is also set as an ``HttpOnly`` ``SameSite=Lax``
          *     cookie so the browser SPA benefits from automatic credential handling.
          *
-         *     Rate limiting: Exponential backoff on failed attempts. Each wrong password
-         *     incurs an increasing delay (0.5s, 1s, 2s, 4s, 5s max per IP address).
-         *     Requests during the penalty period return ``429 Too Many Requests`` with
-         *     a ``Retry-After`` header.
-         *
          *     Cache invalidation: On successful login, any existing cached sessions for
          *     the same user are invalidated so that stale tokens (e.g., from a stolen
          *     device) cannot be reused beyond the cache TTL window.
@@ -192,7 +187,6 @@ export interface paths {
          *         request: The incoming HTTP request (used to extract client IP).
          *         session_ctx: Session service context containing db and repository.
          *         settings: Application settings (used for session duration and trusted proxies).
-         *         rate_limiter: The login rate limiter (per IP).
          *         session_cache: Session cache for invalidating old sessions on login.
          *
          *     Returns:
@@ -200,7 +194,6 @@ export interface paths {
          *
          *     Raises:
          *         AuthenticationError: if the password is incorrect.
-         *         RateLimitError: if the rate limit is exceeded.
          */
         post: operations["login_api_v1_auth_login_post"];
         delete?: never;
@@ -6274,13 +6267,6 @@ export interface operations {
                 };
                 content?: never;
             };
-            /** @description Too many login attempts, retry after delay */
-            429: {
-                headers: {
-                    [name: string]: unknown;
-                };
-                content?: never;
-            };
             /** @description Setup not complete */
             503: {
                 headers: {