Admin reset mechanism + configurable thresholds for login rate-limiting

[davemachado]

What would you like Grimmory to do?

1. Expose MAX_ATTEMPTS and the AUTH_RATE_LIMIT_WINDOW_MINUTES via application.yml/env vars, defaulting to 5 and 15 (see below).
2. Enhance the UI's error message from "Too many failed login attempts. Please try again later" to "Too many failed login attempts. Please try again in X minutes", based on the Caffeine expiry.
3. Add an admin-only endpoint to clear a lockout for a given user (and maybe IP too)

What problem does this solve for you?

1. AuthRateLimitService hardcodes MAX_ATTEMPTS = 5 and a 15-minute Caffeine expiry. I'd like to configure both of these on my server to give my users more chances when entering their passwords.

2. This helps set expectations to users on how long they need to wait, rather than just being told "later".

3. Currently, the only way to clear a lockout is to restart the entire app since this is all in-memory.

Anything else?

resetLoginAttempts/resetLoginAttemptsByUsername methods already exist but are currently only used in the successful login path

Want to help out?

Yes! I'd love to help implement this

Before submitting

• I've searched existing discussions and this hasn't been suggested yet
• I've reviewed this report and have completed it as fully as I can