[SandObserver]

Summary

• Add knownHost to host-check.js (local name or listed in allowedHosts) and reuse it in refusedHost.
• Key failed sign-in attempts on the client IP plus an unlisted marker when the Host header is not known, in login, set-password and clear.

Testing
All green. Added 3 tests for the separate counters.

Changelog

Security

• A page on another site can no longer lock the owner out of sign-in by pointing its host name at the server.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.