fix: secure email regex against ReDoS vulnerability

- Replace vulnerable regex with bounded quantifiers
- Add email length check (max 254 chars per RFC 5321)
- Fixes SonarQube security hotspot S5852

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/controllers/auth.controller.js

@@ -328,9 +328,9 @@ export const checkEmail = asyncHandler(async (req, res, next) => {
     return next(new AppError('Email requis', 400));
   }
 
-  // Validation format email
+  // Validation format email (regex sécurisée contre ReDoS avec limite de longueur)
-  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+  const isValidEmail = email.length <= 254 && /^[a-zA-Z0-9.!#$%&'*+/=?^_`{|}~-]+@[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?)*$/.test(email);
-  if (!emailRegex.test(email)) {
+  if (!isValidEmail) {
     return res.json({
       success: true,
       isValid: false,