feat(server): admin UI to view and reset login rate-limit locks

[dvcdsys]

Summary

The login limiter (loginlimiter.go) blocks brute-force attempts per IP and per (IP, email), but until now the only way to lift a lock early was a server restart (which wipes all in-memory state). A legitimate user who fat-fingered their password from a shared office IP was stuck for the full 15-minute window with no admin recourse.

This adds observability + targeted clearing to the limiter, plus an admin surface to act on it.

What's in here

Backend

• loginLimiter.locks() — snapshot of every counter currently at/over its limit (prune-on-read, so the maps don't grow between logins). clearIP / clearKey lift one specific lock.
• GET /api/v1/admin/login-locks — list active locks (Admin).
• POST /api/v1/admin/login-locks/reset — clear the exact row the admin picked (type=ip | ip_email); Admin-only, idempotent 204.
• Spec-first: doc/openapi.yaml updated → openapi.gen.go regenerated (the large gen diff is the re-encoded embedded spec blob, not logic).

Dashboard

• New Login security admin module (src/modules/login-locks/): table of active locks (type / IP / email / attempts / when it frees) with a per-row Reset button, 15s polling, empty state. Registered admin-only (requiredRole: 'admin').

Design notes

• Limiter state is in-memory, per-process, wiped on restart and self-heals as the sliding windows expire (5/15min per pair, 60/min per IP). This is an operational convenience, not a persisted store.
• Reset deliberately acts on the exact row surfaced in the list (it never scans "all IPs for an email"), so an admin can't clear more than they can see.

Auth

Both endpoints are Admin (mustBeAdmin); docs/AUTH_REVIEW.md matrix updated locally (that file is gitignored).

Tests

loginlocks_admin_test.go:

• non-admin → 403 on both endpoints
• full cycle: 5 failed logins → 429 → list shows one ip_email lock → admin resets → login no longer throttled
• reset validation (missing ip, bad type, ip_email without email, idempotent no-op)

All server tests green; dashboard typecheck + build pass.

🤖 Generated with Claude Code