SA-005 addressed by updateing ratelimiting

Security-audit.md

@@ -89,13 +89,13 @@ These findings are prioritized below. Severity describes the potential security
 
 ### SA-005: Login endpoint lacks rate limiting and lockout
 
-**Severity:** High  
-**Evidence:** `POST /api/auth/login` in `backend/app/api/auth.py` has no IP, username, or account rate limit. The OTP verification path is also not rate-limited separately.  
-**Impact:** Attackers can perform password guessing and OTP guessing at high speed. Sending a password-reset email after failed authentication can also be abused to generate mail volume and user harassment, even though the response remains generic.
+**Severity:** High, remediated in current worktree  
+**Evidence before remediation:** `POST /api/auth/login` had no IP, email, or account rate limit, and OTP failures were not throttled separately.  
+**Current state:** Login failures are tracked in SQLite by a SHA-256 key derived from client IP and normalized email. Five failures within 15 minutes cause a two-minute lockout; the endpoint returns `429` with `Retry-After`, and successful password plus OTP authentication clears the counter. Password-reset mail remains generic and should still be rate-limited operationally.
 
-**Recommendation:** Add a distributed rate limiter keyed by IP and normalized username, with conservative burst limits, exponential backoff, and monitoring. Rate-limit password-reset issuance independently and avoid sending reset mail for every failed attempt. Consider temporary account protection after repeated failures without creating a user-enumeration oracle. Return `Retry-After` where appropriate.
+**Recommendation:** Use a distributed limiter for multi-instance deployments, add monitoring, and rate-limit password-reset issuance independently. Keep responses generic to avoid account enumeration.
 
-**Priority:** High.
+**Priority:** Completed for the single-instance SQLite deployment; distributed limiting and reset-mail controls remain.
 
 ### SA-006: Firefox extension has broad host access and stores bearer tokens in local storage