feat(auth): add LoginAttempt schema and record login attempts with failure rate limit

- Added `LoginAttempt` Mongoose schema to store login history
- Integrated login attempt recording into login flow (success/failure)
- Created `rateLimitByAccount` middleware to block login if 10 failed attempts in 10 minutes

packages/models/index.ts

@@ -4,6 +4,7 @@ export { User, IUser } from './user.js'
 export { Session, ISession } from './session.js'
 export { Command, ICommand } from './command.js'
 export { UserProfile, IUserProfile, IProgress } from './userProfile.js'
+export { ILoginAttempt, LoginAttempt } from './loginAttempt.js'
 
 export async function connectDB(uri: string) {
   const db = await mongoose.connect(uri)

packages/models/loginAttempt.ts

@@ -0,0 +1,29 @@
+import { model, Schema, Document } from 'mongoose'
+
+export interface ILoginAttempt {
+  username: string
+  ip: string
+  userAgent: string
+  time: Date
+  success: boolean
+  message: string
+}
+
+export type LoginAttemptDocument = ILoginAttempt & Document
+
+const LoginAttemptSchema = new Schema<LoginAttemptDocument>(
+  {
+    username: { type: String, required: true },
+    ip: { type: String, required: true },
+    userAgent: { type: String, required: true },
+    time: { type: Date, default: Date.now, required: true },
+    success: { type: Boolean, required: true },
+    message: {type: String}
+  },
+  { timestamps: true }
+)
+
+export const LoginAttempt = model<LoginAttemptDocument>(
+  'LoginAttempt',
+  LoginAttemptSchema
+)