login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)

run.sh

@@ -25,8 +25,9 @@ fi
 
 # ANIWEB_SECURE=1: session cookie is Secure — only usable via the HTTPS
 # proxy (plain http://<this machine>:8321 can no longer hold a session).
-# ANIWEB_TRUST_XFF=1: behind that same local proxy, so X-Forwarded-For may
-# be trusted for the per-IP login budget (server/auth.py).
+# ANIWEB_TRUST_XFF=1: prod traffic arrives via the local HTTPS proxy, so the
+# per-IP login budget keys on X-Forwarded-For; without the flag auth.py uses
+# the socket peer only (the header is spoofable on a direct connection).
 ANIWEB_SECURE=1 ANIWEB_TRUST_XFF=1 nohup .venv/bin/python -m uvicorn server.app:app --host 0.0.0.0 --port 8321 --timeout-graceful-shutdown 3 > server.log 2>&1 &
 echo $! > "$PIDF"
 echo "ani-web on http://localhost:8321 (pid $(cat "$PIDF")) — use the HTTPS proxy to log in"