Abuse GraphQL aliasing to smash rate limits

Aliases let you run the same mutation hundreds of times in one HTTP request, sailing past per-request throttles on OTP or login.