feat(auth): add login brute-force protection

[koishi514-Z]

Description

Add protection for password login attempts to prevent online brute-force attacks.

• Rate-limit POST /api/v1/auth/login by client IP.
• Default to 10 attempts per 10-minute rolling window; use Redis for shared limits across instances and fall back to in-memory limits when Redis is unavailable.
• Return HTTP 429 with a Retry-After header when the limit is exceeded.
• Add a dedicated login-page notice with a countdown and temporarily disable password-login inputs and submit button.
• Add configuration options and document them:
  • auth.login_rate_limit_max
  • auth.login_rate_limit_window_minutes

Type of Change

• 🐛 Bug fix
• ✨ New feature
• 💥 Breaking change
• 📚 Documentation update
• 🎨 Refactor
• ⚡ Performance improvement
• 🧪 Test
• 🔧 Configuration / Build / CI

Related Issue

Fixes #2513

Testing

The following checks passed:

go test ./internal/middleware ./internal/config ./internal/router
git diff --check origin/main...HEAD
npm run type-check
npm run check-i18n
npm run build

Manual verification:
Start the rebuilt Docker services.
Submit 10 password-login attempts from the same IP.
Verify that the next request returns 429 and includes Retry-After.
Verify that the login page displays the rate-limit notice and countdown, disables password login during the countdown, and re-enables it afterward.

Checklist

• git diff --check origin/main...HEAD passes
• Changed source files are formatted
• Targeted tests for the changed packages/components pass
• Diff-scoped lint passes where applicable (for Go: golangci-lint run --new-from-rev=origin/main ./...)
• Full-repository checks were run, or any unrelated/environment-dependent failures are documented above
• Self-reviewed the code
• Added/updated tests covering the change
• Updated related documentation (README, docs/, Swagger annotations, etc.)
• Breaking changes are clearly called out in the description above

Screenshots / Recordings

[lyingbug]

这会不会导致公司网络使用同一个出口IP情况下集体被封禁。或者有恶意用户刷接口导致集体429