feat(auth): add login brute-force protection (#2723)

[sakitam-fdd]

Scope

Port Tencent#2723 onto current main.

• Rate-limits password login by client IP.
• Defaults to 10 attempts per 10-minute window.
• Uses Redis when available with in-memory fallback.
• Returns 429 + Retry-After and adds frontend countdown/disable behavior.
• Adds config/tests/docs for the login protection.

Upstream currently reports a stale-branch conflict, but GitHub's three-way merge against the fork's current main is clean. Effective diff remains the expected 14 auth/config/UI/test files.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3a10e20d-ff45-40c1-97fc-a82247bd2e9e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}