- Add createRateLimit(maxAttempts, windowMs) factory function - Rewrite rateLimit export to delegate to factory (backward compatible) - Keep shared store, getClientIp, cleanup, and _resetForTesting unchanged - Add createRateLimit factory test suite with 5 test cases - All existing rateLimit middleware tests still pass