Password login has no rate limiting; brute force is unbounded

[serendipty01]

What happened

UserApi.login accepts unlimited attempts per account; trust proxy: true makes IP-keyed limiting useless;

Possible Solution

Redis fixed-window counter keyed on email, 10 attempts → 15-min block.

Version/commit

No response

Affected browser(s)

No response

Relevant logs/errors

Anything else

No response

Screenshots

No response

Checklist

• I’ve reviewed and agree to follow the code of conduct