case 4726 - login lockout per login name and per address

Failed logins are counted in memory (util/LoginThrottle.cs): 10 per login
name or 50 per client address within 15 minutes, then attempts are refused
with 429 for the rest of the window without checking the password. A
correct password clears the login's count; loopback is not counted per
address. Each lockout is logged. F6 fixed (2FA part in case 4710).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/8.0/ayanova/docs/changelog.md

@@ -27,6 +27,7 @@ IN PROGRESS
 - Server: log files are now named with an increasing number when they are archived; the [server log](ops-log.md) form lists them newest first.
 - Server: removed an unused internal performance profiling component.
 - Server: AyaNova now checks the email (SMTP) server's security certificate when sending email. If your mail server uses a self-signed or internal certificate and email notifications stop after upgrading, see [SMTP certificate check](ops-config-smtp-accept-any-certificate.md).
+- Server: after repeated failed login attempts, further attempts for that login, or from that address, are refused for a few minutes.
 - Server: when a user's password is reset or set by an administrator, or their login is disabled, they are signed out and must sign in again.
 - Server: on a server with a purchased license, the SuperUser account can only be used to change its password while it still has the default password, and the login form no longer offers the default SuperUser login. See [SuperUser login](ay-start-login.md).
 - Server: the SMTP server password is no longer shown in the [notification settings](ops-notification-system.md) form; it shows `********` when a password is set. Type a new password to change it.