[DJAngel973]

Summary

Implements SEC-005 failed-login lockout and updates the SEC-004 completion record.

Commits included

1. fix(auth): enforce failed-login lockout

   • Adds persisted failed-login accounting.
   • Uses REQUIRES_NEW so counter updates survive failed authentication rollback.
   • Uses pessimistic locking to serialize concurrent account attempts.
   • Locks accounts after five consecutive failures for 30 minutes.
   • Adds audit and CRITICAL security events.
   • Aligns the PostgreSQL constraint with the configured threshold.

2. fix(auth): reset expired lockout counters

   • Starts a new failed-login sequence after lock expiration.
   • Prevents an immediate re-lock after the 30-minute period.
   • Updates outdated security and behavior comments.

Security

• OWASP A07: temporary account lockout against brute-force attempts.
• OWASP A09: failed logins and lockouts generate audit evidence.
• Wrong-password and unknown-email responses remain non-enumerating.
• Passwords and tokens are never logged.