login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)

tests/conftest.py

@@ -53,10 +53,10 @@ def server():
 
     data = Path(tempfile.mkdtemp(prefix="aniweb-test-"))
     os.environ["ANIWEB_DATA"] = str(data)
-    # the per-IP login budget must never trip during the suite (all tests
-    # share 127.0.0.1); per-username lockout stays at production defaults
-    os.environ.setdefault("ANIWEB_IP_FAILS", "1000")
-    os.environ.setdefault("ANIWEB_IP_WINDOW", "300")
+    # test-tuned throttle: small IP budget + short window so the per-IP test
+    # can both trip the gate and watch it expire inside one test run
+    os.environ["ANIWEB_IP_FAILS"] = "10"
+    os.environ["ANIWEB_LOCK_WINDOW"] = "8"
     sys.path.insert(0, str(ROOT))
     from server import db, users  # noqa: E402
     db.init()  # schema before users.add / seeding