feat(backend): per-IP login rate limit with proxy-aware client IP

Adds clientIP() (reads the rightmost X-Forwarded-For hop via
Header.Values, since Traefik appends the peer address it actually
observed and the leftmost entries are client-controlled) and
loginLimiter, an in-memory per-IP counter that blocks after
loginMaxFailures within loginWindow. No routes wire these up yet —
that lands in Task 5.

backend/session.go

@@ -5,9 +5,11 @@ import (
 	"crypto/sha256"
 	"crypto/subtle"
 	"encoding/base64"
+	"net"
 	"net/http"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 )
 
@@ -87,3 +89,93 @@ func clearSessionCookie(w http.ResponseWriter, r *http.Request) {
 		SameSite: http.SameSiteLaxMode,
 	})
 }
+
+const (
+	loginMaxFailures = 10
+	loginWindow      = 20 * time.Minute
+)
+
+// clientIP returns the address the reverse proxy actually observed.
+//
+// Traefik appends the peer address to whatever X-Forwarded-For the client sent,
+// so the leftmost entry is attacker-controlled and the rightmost is not. Go's
+// Header.Get would only read the first header line, which a client can preempt
+// by sending its own; Values covers every line so the true last hop is found.
+// RemoteAddr is useless behind the proxy — it is always the Traefik container —
+// so it serves only as the direct-connection fallback for local development.
+func clientIP(r *http.Request) string {
+	if vals := r.Header.Values("X-Forwarded-For"); len(vals) > 0 {
+		hops := strings.Split(vals[len(vals)-1], ",")
+		if ip := strings.TrimSpace(hops[len(hops)-1]); ip != "" {
+			return ip
+		}
+	}
+	host, _, err := net.SplitHostPort(r.RemoteAddr)
+	if err != nil {
+		return r.RemoteAddr
+	}
+	return host
+}
+
+// loginLimiter throttles password guessing: loginMaxFailures failures inside a
+// rolling loginWindow blocks further attempts from that IP until the oldest one
+// ages out. There is no permanent ban and no unlock step.
+//
+// Behind carrier-grade NAT this budget is shared with every other subscriber on
+// the same public address, so a stranger can lock the owner out for up to one
+// window. That is accepted: the block self-heals, and ten attempts is generous
+// for a mistyped password.
+//
+// State is in memory and per-process, so a restart clears it. Entries are
+// pruned lazily on access; for a single-user deployment the map cannot grow
+// past the handful of addresses that ever attempt a login.
+type loginLimiter struct {
+	mu       sync.Mutex
+	failures map[string][]time.Time
+}
+
+func newLoginLimiter() *loginLimiter {
+	return &loginLimiter{failures: make(map[string][]time.Time)}
+}
+
+// retryAfter returns how long ip must wait, or zero when it may try now.
+func (l *loginLimiter) retryAfter(ip string, now time.Time) time.Duration {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+
+	recent := l.pruneLocked(ip, now)
+	if len(recent) < loginMaxFailures {
+		return 0
+	}
+	return recent[0].Add(loginWindow).Sub(now)
+}
+
+func (l *loginLimiter) fail(ip string, now time.Time) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	l.failures[ip] = append(l.pruneLocked(ip, now), now)
+}
+
+func (l *loginLimiter) reset(ip string) {
+	l.mu.Lock()
+	defer l.mu.Unlock()
+	delete(l.failures, ip)
+}
+
+// pruneLocked drops attempts older than the window and returns what is left.
+// The caller must hold l.mu.
+func (l *loginLimiter) pruneLocked(ip string, now time.Time) []time.Time {
+	cutoff := now.Add(-loginWindow)
+	kept := l.failures[ip][:0]
+	for _, at := range l.failures[ip] {
+		if at.After(cutoff) {
+			kept = append(kept, at)
+		}
+	}
+	if len(kept) == 0 {
+		delete(l.failures, ip)
+		return nil
+	}
+	l.failures[ip] = kept
+	return kept
+}