[amar-python]

Fixes #102 (approved by you on 26 Oct). Part of ART Milestone 2 (BR-36).

Behaviour

• The lock. After 10 wrong passwords within 15 minutes, the account is locked for 15 minutes. Both numbers are configurable: LOGIN_MAX_FAILURES and LOGIN_LOCKOUT_MINUTES.
• What a locked account sees. Sign-in returns the same 401 as any other failure, so the response doesn't reveal that the account exists. Password checking still runs, so a locked attempt takes as long as any other.
• Resetting the count. A successful sign-in clears it. So do failures more than 15 minutes apart, which start a new count.
• What counts. Only wrong passwords for a real user. A correct password for a tenant the user doesn't belong to doesn't count.
• The rate limit stays. The existing per-client limit (20 writes a minute) still applies on top.
• Migration 0005. Adds the counters to control.users. Like 0004, it only touches the shared control schema, not tenant schemas.

Evidence

All runs are against local PostgreSQL 16.

Check	Result
Local replica of the CI integration job (scripts/test_report.py --strict)	285 passed, 0 failed, 0 skipped (281 on main + 4 new)
Evals p,i,s,e	26/26
tests/test_accounts.py	16 passed, including 4 lockout tests: • the 11th attempt is refused even with the right password • 9 failures and then a success resets the count • the lock expires • old failures fall out of the window
Same tests with the lock check removed	lockout test fails (as expected)
DB-free pytest	128 passed
scripts/lint.sh	clean

---

Generated by Claude Code