fix(auth): widen the per-IP login throttle to 50, keep the per-account lockout at 10

One AUTH_FAILURE_MAX (10 per 15 min) gated the single-user per-IP
bucket, the multi-user per-IP pre-gate, the per-username lockout and the
hook-secret bucket. Clients sharing one egress IP (NAT, a tunnel, an
automated client retrying) were throttled after 10 failures in total.

Add AUTH_IP_FAILURE_MAX = 50 and use it for the two per-IP login buckets
only. The per-username lockout and the hook-secret bucket keep
AUTH_FAILURE_MAX = 10, so guessing against any one account, or against
the hook secret, is no easier than before.

src/config/auth-config.ts

@@ -21,9 +21,20 @@ export const MAX_AUTH_SESSIONS = 100;
 // Rate Limiting
 // ============================================================================
 
-/** Max failed auth attempts per IP before 429 rejection */
+/**
+ * Max failed auth attempts per bucket before 429 rejection. Applies to the
+ * per-username lockout and the hook-secret bucket.
+ */
 export const AUTH_FAILURE_MAX = 10;
 
+/**
+ * Max failed login attempts per client IP before 429 rejection. Wider than
+ * AUTH_FAILURE_MAX because one egress IP (NAT, a tunnel, an automated client) can
+ * carry many users' or retries' failures; the per-username lockout above still
+ * caps guesses against any one account.
+ */
+export const AUTH_IP_FAILURE_MAX = 50;
+
 /** Failed auth attempt tracking window (ms) */
 export const AUTH_FAILURE_WINDOW_MS = 15 * 60 * 1000;