[Bug]: Preserve WebUI credentials during backup restore and harden login token handling #263

Short description

Track two WebUI hardening issues reported through GitHub Security Advisory GHSA-w9h7-fgpw-3968:

1. The access token on the login endpoint is compared with a regular equality check and the endpoint has no login-attempt rate limit.
2. Restoring a backup can replace data/webui.json (including access_token) and data/.jwt_secret with values from the archive.

Steps to reproduce

1. For the login path, inspect webui/routes/auth.py: the submitted access token is compared using !=, and repeated failed requests to /api/auth/login are not throttled.
2. Create or obtain a backup containing webui.json and .jwt_secret, then restore it through the WebUI. The restore process copies these credential files into the active data directory.

Expected behavior

1. Compare access tokens in constant time, and add login-attempt protection that remains compatible with supported self-hosted and reverse-proxy deployments.
2. A backup restore must not silently replace the active access token or JWT signing secret.

Actual behavior

1. The comparison can short-circuit and unlimited failed login attempts are accepted.
2. A restored archive can change the running credentials, potentially causing an administrator lockout or adopting credentials present in the archive.

KiraAI version

v2.30.0 (1228ac2) and earlier, according to the original report.

Environment

Self-hosted WebUI; not specific to an operating system or Python version.

Logs / traceback

Not applicable; this was identified by static code review.

Additional context

• Original reporter: @LyaQanYi.
• Original submission: GitHub Security Advisory GHSA-w9h7-fgpw-3968.
• The same advisory also reported unbounded plugin and sticker uploads. That item is already tracked in [Bug]: WebUI 缺陷汇总：多个 async 路由阻塞事件循环 / 上传体无大小上限 / GET sessions 隐式创建会话 / en.ts 缺少 network 键 #252 and is intentionally not duplicated here.