feat: add login attempt throttling

[veeceey]

Adds configurable login throttling to protect against brute force credential attacks. This has been a long-requested feature (#3037, #654).

What it does

Tracks failed login attempts per identity in memory and temporarily locks out accounts that exceed a configurable threshold. Config looks like:

selfservice:
  flows:
    login:
      throttle:
        max_attempts: 5
        window: 5m
        lockout_duration: 15m

When disabled (max_attempts: 0, the default), behavior is unchanged from today.

How it works

• New throttle.Limiter in selfservice/flow/login/throttle/ does the actual tracking with a sliding window approach
• On failed login: records the failure, if threshold exceeded returns 429
• On successful login: clears the failure history
• Cleanup() method prevents unbounded memory growth
• Config accessors added to driver/config for the three settings
• Also added ExtractIdentityID helper in x/err.go to pull identity IDs from wrapped errors

Limitations / future work

This is an in-memory implementation, so it won't persist across restarts and doesn't share state across multiple kratos instances. A database-backed implementation (as outlined in the original issue) would be the next step, but this gets the core logic and config in place.

Tests

$ go test ./selfservice/flow/login/throttle/... -v
=== RUN   TestLimiter_BasicLockout
--- PASS: TestLimiter_BasicLockout (0.00s)
=== RUN   TestLimiter_SuccessResetsCounter
--- PASS: TestLimiter_SuccessResetsCounter (0.00s)
=== RUN   TestLimiter_DifferentIdentities
--- PASS: TestLimiter_DifferentIdentities (0.00s)
=== RUN   TestLimiter_UnknownIdentity
--- PASS: TestLimiter_UnknownIdentity (0.00s)
=== RUN   TestLimiter_Cleanup
--- PASS: TestLimiter_Cleanup (0.02s)
=== RUN   TestDefaultConfig
--- PASS: TestDefaultConfig (0.00s)
PASS

$ go build ./selfservice/flow/login/...
# clean build

Relates to #3037

[veeceey]

Test Results

$ go build ./selfservice/flow/login/...
# clean

$ go test ./selfservice/flow/login/throttle/... -v
=== RUN   TestLimiter_BasicLockout
--- PASS: TestLimiter_BasicLockout (0.00s)
=== RUN   TestLimiter_SuccessResetsCounter
--- PASS: TestLimiter_SuccessResetsCounter (0.00s)
=== RUN   TestLimiter_DifferentIdentities
--- PASS: TestLimiter_DifferentIdentities (0.00s)
=== RUN   TestLimiter_UnknownIdentity
--- PASS: TestLimiter_UnknownIdentity (0.00s)
=== RUN   TestLimiter_Cleanup
--- PASS: TestLimiter_Cleanup (0.02s)
=== RUN   TestDefaultConfig
--- PASS: TestDefaultConfig (0.00s)
PASS
ok      github.com/ory/kratos/selfservice/flow/login/throttle  0.257s

$ go test ./x/... -run TestWrapWithIdentityIDError -v
--- PASS: TestWrapWithIdentityIDError (0.00s)
    --- PASS: TestWrapWithIdentityIDError/case=wraps_error_with_identity_ID (0.00s)
    --- PASS: TestWrapWithIdentityIDError/case=unwraps_to_original_error (0.00s)
    --- PASS: TestWrapWithIdentityIDError/case=returns_nil_when_wrapping_nil_error (0.00s)
    --- PASS: TestWrapWithIdentityIDError/case=preserves_identity_ID_with_nil_UUID (0.00s)
    --- PASS: TestWrapWithIdentityIDError/case=can_wrap_already_wrapped_error (0.00s)
    --- PASS: TestWrapWithIdentityIDError/case=works_with_errors.Is (0.00s)
PASS

[CLAassistant]

All committers have signed the CLA.