services: throttle emailed codes to stop RESEND/RESETPASS email-bombing

REGISTER was rate-limited but RESEND and RESETPASS weren't — anyone could
repeatedly request confirmation/reset codes for any account with an address
on file, flooding the victim's inbox and burning the service's sender
reputation. A per-account 60s cooldown (code_issue_wait, mirroring the vhost
request throttle) now gates both paths; guessing was already infeasible
(2^40 code + 5-try limit), so this closes the abuse, not an auth hole.

src/engine/db/store.rs

@@ -125,6 +125,9 @@ impl Store for Db {
     fn vhost_request_wait(&self, account: &str) -> u64 {
         Db::vhost_request_wait(self, account)
     }
+    fn code_issue_wait(&self, account: &str) -> u64 {
+        Db::code_issue_wait(self, account)
+    }
     fn take_vhost_request(&mut self, account: &str) -> Result<Option<String>, RegError> {
         Db::take_vhost_request(self, account)
     }