M2a-2: lock accounts after repeated failed sign-ins (BR-36) #102

Part of ART Milestone 2 (BR-36). Approved by the product owner on 26 Oct.

• Lock an account for 15 minutes after 10 failed sign-in attempts within 15 minutes.
• While an account is locked, sign-in returns the same 401 as any other failure, so the response doesn't reveal that the account exists.
• A successful sign-in clears the failure count.

This sits on top of the existing per-client rate limit (20 writes a minute).

Verified by integration tests: the 11th attempt is refused even with the right password; sign-in works again after the window; one success resets the count.

Generated by Claude Code