feat: Built-in brute-force protection with IP blocking and user lockout

[mrmm]

Summary

This PR adds fail2ban-like login protection to Warpgate with:

• IP-based rate limiting - Automatically blocks IPs after configurable failed login attempts
• Exponential backoff - Each subsequent block has longer duration (30min → 1h → 2h → ... → 24h max)
• User account lockout - Locks accounts after repeated failures (optional auto-unlock)
• Cross-protocol protection - Failed attempts across SSH, HTTP, MySQL, PostgreSQL all count together
• Admin management - View status, unblock IPs, unlock users via Admin UI or API
• In-memory caching - Fast lookups with periodic database sync

Configuration

login_protection:
  enabled: true
  ip_rate_limit:
    max_attempts: 5
    time_window_minutes: 15
    base_block_duration_minutes: 30
    block_duration_multiplier: 2.0
    max_block_duration_hours: 24
  user_lockout:
    max_attempts: 10
    time_window_minutes: 60
    auto_unlock: false
  retention_days: 30

Admin API Endpoints

• GET /login-protection/status - Security overview
• GET /login-protection/blocked-ips - List blocked IPs
• DELETE /login-protection/blocked-ips/:ip - Unblock an IP
• GET /login-protection/locked-users - List locked users
• DELETE /login-protection/locked-users/:username - Unlock a user

Test plan

• Docker Compose local setup - containers start correctly
• IP blocking test - after 3 failed attempts, returns {"state":"IpBlocked"}
• User lockout test - account locks after threshold
• Integration tests - pytest tests pass
• Build - cargo build succeeds
• Admin UI - Login Protection page shows stats and lists