fix(auth): per-purpose throttles, per-address sign-in backoff, constant-work login (#688)

[alex-dembele]

Closes #688

Stacked on #689 (PR #871): it reuses #689's authmfa.AttemptStore for the per-address lock. Base is #689's branch; once #871 merges, GitHub retargets this PR to master. Spec: docs/688_AUTH_THROTTLE.md.

What changes

• One throttle bucket per purpose (per IP): login, sign-up, reset, the password-strength meter and re-auth each get their own key. Typing on the sign-up screen no longer locks anyone out of signing in.
• Readable 429s: Retry-After header plus code/retry_after in the body. Sign-in and sign-up say how long to wait, in FR and EN.
• Per-address backoff: 10 failed sign-ins on one address, from any source → 15-min lock. The lock is bounded, and a password reset ends it. Each failure is audited with the address hashed.
• Equal work: unknown and disabled addresses cost one Argon2id comparison, like a wrong password.
• Case-insensitive lookup: GetByEmail matches LOWER(email), and legacy duplicates resolve deterministically.

Verification

Backend gate (cd backend && go build ./... && go vet ./... && go test ./... -race): BUILD_OK · VET_OK · TEST_OK, 80 packages ok, 0 FAIL.

Frontend gate: npx tsc -b --noEmit exit 0 · npx vitest run → 102 files, 950 tests passed · npm run build → built in 4.97s · eslint src/features/auth → 2 errors, both already on master, in MFAEnrollmentBanner.tsx:61 and MFAPostAhaPrompt.tsx:64, neither touched here. The 6 new tests in authThrottle.test.tsx fail with the old AuthScreen.tsx and pass with the new one.

Named tests: TestLogin_UnknownAddressCostsAHashComparison, TestLogin_EmailCaseInsensitive, TestAuthRateLimit_PasswordCheckDoesNotConsumeLoginBudget, TestLogin_PerAccountBackoff, plus TestLogin_Success/_NotFound/_Unauthorized, TestConfirmPasswordReset_ClearsLoginLock, TestGetByEmail_CaseInsensitive, TestGetByEmail_LegacyMixedCaseRows, TestLoginThrottle_LockedAddressAnswers429AndEveryFailureIsAudited, TestRateLimit_RefusalCarriesRetryAfterAndCode.

Live (throwaway Postgres 18 + Redis, branch server, 2026-10-02):

Reproduction 1, run again:

121 × POST /auth/password/check → 120 × 200, then 429
122nd: HTTP 429 · Retry-After: 282 · {"code":"RATE_LIMITED","error":true,"msg":"Rate limit exceeded","retry_after":282}
POST /auth/login (valid)    → 200
POST /auth/register (new)   → 201

Reproduction 2, run again (20 attempts each, wrong password, one source IP per request):

unknown  n=20 codes=['401'] median=44.6 ms  min=37.5  max=54.5
existing n=20 codes=['401'] median=46.6 ms  min=37.7  max=53.3
difference of medians = 2.0 ms (criterion: < 10 ms)

Reproduction 4, run again (account registered as awa.diallo@e2e.test):

'Awa.Diallo@E2E.test'   → HTTP 200 user.email= awa.diallo@e2e.test
'AWA.DIALLO@E2E.TEST'   → HTTP 200 user.email= awa.diallo@e2e.test
' awa.diallo@e2e.test ' → HTTP 200 user.email= awa.diallo@e2e.test

Per-address backoff (criterion 3):

10 wrong passwords, alternating 127.0.0.70 / .71 → 10 × 401
11th, RIGHT password, from 127.0.0.80 → 429 · Retry-After: 900 · {"code":"LOGIN_LOCKED",...,"retry_after":900}
redis: mfa-attempts:login:lock:ed0afddf… ttl=900s
audit: 5 × .50 / 5 × .51 "authentication failed email_sha256=ed0afddf…", 1 × "login_locked email_sha256=ed0afddf…"  (= sha256("awa.diallo@e2e.test"); the address never appears in clear)
forgot → 200 · mailed link → reset → 200 · lock keys after reset: 0 · login with new password → 200

Browser (Vite against the branch server): sign-in on the locked address shows "Trop de tentatives. Réessayez dans 15 minutes."; sign-up in EN with the IP's sign-up budget used up shows "Too many attempts. Try again in 7 minutes."

Honest remainders

• No lower(email) index: login does a scan of users until a migration can be numbered (see bug(auth): registration refuses people sharing an email local part, accepts case-variant duplicates, and is not atomic #687). Follow-up issue not yet opened.
• The audit hash is unsalted SHA-256, as reset already uses: it can be reversed against a list of known addresses.
• If Redis is down, buckets and locks are per instance, and Retry-After can be early by up to one window.
• Anyone can pause any address for 15 minutes, again and again. The owner's way out is a password reset (same trade-off as security(auth): MFA challenge codes can be guessed without limit — no attempt counter, no rate limit #689).
• Pre-existing, not touched: AuditService.LogFiber records raw X-Forwarded-For as the audit IP. Two eslint errors in MFAEnrollmentBanner.tsx and MFAPostAhaPrompt.tsx.