Rate limiting and lockout

Two independent protections operate at different granularities.

Per-source-IP rate limiting is keyed on the route group and the caller's
address: five login attempts per five minutes, thirty system calls per minute,
sixty self-service calls per minute, and one hundred per minute by default.
A single operator setting halves every limit. Keys may be marked rate-limit
exempt — the Prometheus scrape credential is.

Per-username account lockout is separate: ten failures within a fifteen-minute
window triggers a thirty-minute lock; a successful authentication clears the
record entirely.

The asymmetry is intentional. The per-IP limit returns an informative 429
because it is keyed on the caller's own address and disclosing it is safe. The
per-username lockout returns an opaque 401 because it is keyed on someone
else's identity and disclosing it is not.