feat(auth): add LoginAttempt schema and record login attempts with failure rate limit

- Added `LoginAttempt` Mongoose schema to store login history
- Integrated login attempt recording into login flow (success/failure)
- Created `rateLimitByAccount` middleware to block login if 10 failed attempts in 10 minutes

server/src/middleware/recordLogin.ts

@@ -0,0 +1,17 @@
+import { Request, Response, NextFunction } from 'express'
+import { LoginAttempt } from '../../../packages/models'
+
+export async function recordLogin(
+  req: Request,
+  success: boolean,
+  message: string
+) {
+  await LoginAttempt.create({
+    ip: req.ip,
+    userAgent: req.headers['user-agent'] || '',
+    success,
+    time: new Date(),
+    username: req.body.username,
+    message,
+  })
+}