v2.11.0: feat(auth): Expose login throttling status to the user

Allows forms to display remaining attempts and blocked-until times, instead of a generic "invalid credentials" message. This improves user experience for throttled users by clearly communicating their status and when they can retry, reducing support inquiries. Comprehensive tests are added to validate the throttling logic.