- Added `LoginAttempt` Mongoose schema to store login history - Integrated login attempt recording into login flow (success/failure) - Created `rateLimitByAccount` middleware to block login if 10 failed attempts in 10 minutes