feat(auth): add login throttling and audit events

[Vann-Dev]

Summary

• add a small database-backed login throttle keyed by normalized username and client IP
• log successful/failed/throttled auth attempts to company audit logs when a user/company exists, with safe generic details only
• keep login errors generic and clear throttle state after successful sign-in

Checks

• corepack pnpm lint
• DATABASE_URL=postgresql://user:pass@localhost:5432/db?schema=public corepack pnpm typecheck
• DATABASE_URL=postgresql://user:pass@localhost:5432/db?schema=public AUTH_SECRET=placeholder corepack pnpm build

Build note: Next.js still emits the existing middleware-to-proxy deprecation warning.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
agent-bridge	Error		May 12, 2026 10:07am

[Vann-Dev]

Kaito is investigating the Vercel failure. I don't have Vercel CLI credentials in this worker, but local install/build pass on the PR head. To refresh the external Vercel status, please re-run the Vercel deployment/check for commit 02eaf85 or share the output if it still fails.

[Vann-Dev]

Correction: the Vercel command from the status is npx vercel inspect dpl_ARtkpx8rudu1Sb6ihdQNHr2iR7n2 --logs. This worker has no Vercel credentials/token, so I cannot inspect those deployment logs directly here.

[Vann-Dev]

Update: I pushed empty commit 270cdd1 to force a fresh Vercel deployment. The new Vercel status still fails immediately and reports npx vercel inspect dpl_8ybh5Lqy5HhRVotMCzDancjy2Xq6 --logs. This worker still has no Vercel credentials/token, so npx vercel inspect ... --logs returns No existing credentials found; I cannot see the Vercel build logs from here. Local checks continue to pass, so this is currently blocked on Vercel log access or someone with project access rerunning/inspecting the failed deployment.