M4-T02: add exponential login back-off service and wire into login endpoint

openapi/openapi.json

@@ -653,7 +653,7 @@
           "api-session"
         ],
         "summary": "Post Login",
-        "description": "Authenticate with username and password.\n\nOn success, sets an HttpOnly session cookie and returns the session user + CSRF token.\nOn failure, returns 401 with no cookie set.\nNo X-CSRF-Token required (unauthenticated endpoint).",
+        "description": "Authenticate with username and password.\n\nOn success, sets an HttpOnly session cookie and returns the session user + CSRF token.\nOn failure, returns 401 with no cookie set.\nRepeated failures trigger exponential back-off (429 + Retry-After).\nNo X-CSRF-Token required (unauthenticated endpoint).",
         "operationId": "post_login_api_auth_login_post",
         "requestBody": {
           "content": {

openapi/openapi.yaml

@@ -480,6 +480,8 @@ paths:
 
         On failure, returns 401 with no cookie set.
 
+        Repeated failures trigger exponential back-off (429 + Retry-After).
+
         No X-CSRF-Token required (unauthenticated endpoint).'
       operationId: post_login_api_auth_login_post
       requestBody: