2 Commits

Include renames

Author	SHA1	Message	Date
jozamudi	3e5c7062ab	login: per-source-IP failure budget (auth.py) — username rotation no longer dodges the lockout; sliding window, XFF trusted only behind the proxy (ANIWEB_TRUST_XFF); lockout logic now unit-testable (tests/test_auth.py)	2026-09-16 02:31:23 +00:00
jozamudi	b70ef403a9	Lockout -> server/auth.py + per-IP failure budget (XFF trusted only behind the proxy); unit tests	2026-09-16 01:31:40 +00:00