fix: apply the review items for #684 at merge

Multi-user: add a (username, IP) failure bucket checked before verifyPassword, capped at AUTH_FAILURE_MAX, with the same decay as the other buckets; the per-IP pre-gate stays at AUTH_IP_FAILURE_MAX and the per-username bucket stays after the verify
A correct password now also clears that account's (username, IP) bucket, beside the IP and per-username buckets
The new bucket is disposed on server stop like the others; the comments above the gate and the constants' JSDoc describe the three buckets
Tests: 10 wrong then the correct password from one IP is a 429, the same account logs in from another IP, another account behind that IP is unaffected, and a correct password clears the pair bucket
test/multiuser-auth.test.ts: the spray test loops to AUTH_IP_FAILURE_MAX instead of a literal 50
Reworded the rate-limit lines in auth-config.ts, security-architecture.md, README.md, README.zh-CN.md, wiki/Security.md, endpoints.md (plus the plugin mirror), CLAUDE.md and architecture-invariants.md
docs/wiki/Remote-Access.md: add the multi-user note to the tunnel page

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

src/config/auth-config.ts

@@ -23,17 +23,20 @@ export const MAX_AUTH_SESSIONS = 100;
 
 /**
  * Max failed auth attempts per bucket before 429 rejection. Applies to the
- * single-user per-IP bucket, the multi-user per-username lockout and the
- * hook-secret bucket.
+ * single-user per-IP bucket, the hook-secret bucket and two multi-user buckets:
+ * the (username, IP) gate, checked before the scrypt verify, and the
+ * per-username bucket, checked after it.
  */
 export const AUTH_FAILURE_MAX = 10;
 
 /**
  * Max failed login attempts per client IP for the multi-user pre-gate, which
  * runs before the scrypt verify and so refuses even a correct password once
- * reached. Wider than AUTH_FAILURE_MAX because one egress IP (NAT, a tunnel) can
- * carry many users' failures; the per-username bucket still caps guesses against
- * each account at AUTH_FAILURE_MAX. Single-user mode does not use this.
+ * reached. It bounds scrypt cost from one source and is wider than
+ * AUTH_FAILURE_MAX because one egress IP (NAT, a tunnel) can carry many users'
+ * failures. Verified guesses against any one account are capped by the
+ * (username, IP) gate at AUTH_FAILURE_MAX, not by this. Single-user mode does
+ * not use this.
  */
 export const AUTH_IP_FAILURE_MAX = 50;