Login lockout & rate limiting

Login attempts are throttled two ways: a per-account lockout after repeated wrong passwords, and a request-rate limiter on the login endpoint itself — brute-force controls that run before any password is even checked.

• You're documenting login-security controls for a customer InfoSec review
• You're debugging a 'why is my login blocked' report from a user or from your own testing
• You're tuning the rate limit for a load test or a bulk-onboarding scenario

Five consecutive wrong passwords lock the account for 15 minutes (checked before the bcrypt verify even runs, so the lockout gate is cheap); separately, POST /auth/login is wrapped with a slowapi rate limiter, default 20 requests / 5 minutes, configurable via the LOGIN_RATE_LIMIT env var.