Unlimited failed-login attempts let attackers brute-force weak passwords, and the same flood overloads the auth service so legitimate users can no longer sign in. This adds a per-IP rate limit of 5 attempts per minute enforced at the gateway, returning 429 once the threshold is crossed and logging the source for review. @lena owns the gateway and must deploy it behind the `login_ratelimit` flag before the next security review, otherwise both the brute-force and the overload risks stay open in production.
