Verify login credentials before spending rate-limit budget (closes #150)

With TRUSTED_PROXIES empty behind the reverse proxy production is
required to run behind, every login POST keyed on the proxy's address
and shared one 5/minute bucket. A stranger sending five POSTs a
minute -- 0.08 requests per second, from anywhere -- kept that bucket
permanently full, and the operator's own correct password was answered
429 indefinitely with no second administrative path.

The login POST no longer has a pre-emptive limiter. The handler
verifies credentials first and spends budget only on a FAILED attempt,
so a correct password is never throttled whatever the counters hold.
Three things follow, and are implemented together because the first is
unsafe without the other two:

- Failures are counted per (client bucket, submitted username), five
  per minute, after which further failures get 429 with a Retry-After.
  A successful login clears the counter, so mistyping and then
  succeeding does not leave the operator throttled.
- Both key sets are capped at 1024 entries. The submitted username is
  attacker-controlled, so past the first cap failures fall back to a
  counter keyed on the client alone, and past both caps a failure is
  answered as throttled without being recorded. Tracked state stays
  under half a megabyte and does not grow with invented usernames.
- Concurrent Argon2id verifications are capped at two, a 128 MB
  ceiling at 64 MB per hash. Every password-hashing endpoint takes a
  slot, including the password-change endpoint, which holds one across
  both its hashes. A request that waits five seconds without a slot is
  answered 503 and no hash runs for it.

An unknown username is verified against a dummy hash instead of
returning early, so a nonexistent account costs the same time as a
real one and the response cannot be used to enumerate usernames.

The password-change limiter is unchanged: RequireAuth runs ahead of
it, so only a request already carrying a valid session reaches its
bucket.

Also adds the missing test for the third bucketKey call site, where
the peer is a trusted proxy but the forwarded chain names no client.
Every existing test of that fallback uses an IPv4 proxy, where
bucketKey is the identity function, so dropping the /64 masking there
left the suite green.

README and the TRUSTED_PROXIES startup warning updated: a shared
bucket now costs precision, not the availability of the admin path.

internal/config/config.go

@@ -430,10 +430,14 @@ func loadFromEnv() (*Config, error) {
 // what is in front of the process, which this code cannot observe:
 // with nothing in front, the peer is the client and the limits are
 // per-client as intended; behind a reverse proxy the peer is the proxy
-// for every request, so all clients share one bucket per limiter. The
-// login limiter's bucket is the dangerous one: any remote client can
-// keep it full, which denies the only administrative login to everyone
-// until the process restarts.
+// for every request, so all clients share one bucket per limiter.
+//
+// The login endpoint no longer spends budget on arrival — it verifies
+// credentials first and charges only failures — so a shared bucket
+// cannot deny the operator a correct password. What it does collapse
+// is the failure counting: one client's wrong passwords throttle
+// everyone else's wrong passwords, and the receiver's limits become
+// service-wide ceilings.
 //
 // The warning is deliberately not gated on WEBHOOKER_ENVIRONMENT. That
 // variable defaults to dev, so gating on it would silence the warning
@@ -454,11 +458,11 @@ func (c *Config) warnSharedRateLimitBucket(log *slog.Logger) {
 			"this process that is the client itself and the limits "+
 			"are per-client as intended. Behind a reverse proxy the "+
 			"peer is the proxy on every request, so all clients "+
-			"share one bucket per limit and any remote client can "+
-			"keep the login limit full, denying the admin login — "+
-			"the only administrative path — until restart. If "+
-			"anything proxies to this process, set TRUSTED_PROXIES "+
-			"to its address.",
+			"share one bucket per limit: the receiver limits become "+
+			"service-wide ceilings, and one client's failed logins "+
+			"throttle every other client's failed logins — a "+
+			"correct password still gets in. If anything proxies to "+
+			"this process, set TRUSTED_PROXIES to its address.",
 		"environment", c.Environment,
 		"trustedProxies", len(c.TrustedProxies),
 	)

internal/config/config_test.go

@@ -629,8 +629,9 @@ func testTrustedProxiesSuccess(
 
 // TestSharedRateLimitBucketWarning covers the startup warning that
 // tells an operator a deployment behind a reverse proxy shares one
-// rate-limit bucket between every client, which makes the admin login
-// remotely deniable. It must fire whenever TRUSTED_PROXIES is empty,
+// rate-limit bucket between every client, which turns the receiver
+// limits into service-wide ceilings and collapses login failure
+// counting. It must fire whenever TRUSTED_PROXIES is empty,
 // in any environment: WEBHOOKER_ENVIRONMENT defaults to dev, so gating
 // on it would silence the warning for exactly the operator who never
 // configured the deployment. It stays quiet once proxies are named.
@@ -707,7 +708,15 @@ func TestSharedRateLimitBucketWarning(t *testing.T) {
 			assert.Contains(t, logged, `"level":"WARN"`)
 			assert.Contains(t, logged, "TRUSTED_PROXIES")
 			assert.Contains(t, logged, "share one bucket")
-			assert.Contains(t, logged, "denying the admin login")
+			assert.Contains(
+				t, logged, "throttle every other client's failed logins",
+			)
+			// The warning must not claim a lockout the login
+			// endpoint no longer permits: credentials are verified
+			// before any budget is spent.
+			assert.Contains(
+				t, logged, "a correct password still gets in",
+			)
 			// The text must stay accurate for a developer with
 			// nothing in front of the process, where an empty
 			// list costs nothing.