feat(auth): add login_attempts schema, lockout config, dummy-hash helper

Lays the foundation for brute-force defense: per-username attempt tracking
table, configurable lockout/rate-limit thresholds, and a memoized dummy
bcrypt hash so unknown-user paths can be timed identically to wrong-password
paths in a later step.

Adds @fastify/rate-limit dependency for upcoming per-IP rate-limit on
login routes.

src/db/schema.ts

@@ -22,6 +22,16 @@ export function initDb(dbPath: string): Database.Database {
       stored_name TEXT NOT NULL,
       created_at TEXT DEFAULT (datetime('now'))
     );
+
+    CREATE TABLE IF NOT EXISTS login_attempts (
+      username TEXT PRIMARY KEY,
+      failed_count INTEGER NOT NULL DEFAULT 0,
+      last_failed_at TEXT,
+      locked_until TEXT
+    );
+
+    CREATE INDEX IF NOT EXISTS idx_login_attempts_locked_until
+      ON login_attempts(locked_until);
   `);
 
   return db;