Lockout -> server/auth.py + per-IP failure budget (XFF trusted only behind the proxy); unit tests

tests/conftest.py

@@ -53,6 +53,10 @@ def server():
 
     data = Path(tempfile.mkdtemp(prefix="aniweb-test-"))
     os.environ["ANIWEB_DATA"] = str(data)
+    # the per-IP login budget must never trip during the suite (all tests
+    # share 127.0.0.1); per-username lockout stays at production defaults
+    os.environ.setdefault("ANIWEB_IP_FAILS", "1000")
+    os.environ.setdefault("ANIWEB_IP_WINDOW", "300")
     sys.path.insert(0, str(ROOT))
     from server import db, users  # noqa: E402
     db.init()  # schema before users.add / seeding