Login-Rate-Limit: 5 Fehlversuche pro IP → 5 Min Sperre (konfigurierbar)

lib/config.js

@@ -55,6 +55,8 @@ const config = {
   model: process.env.MODEL || env.MODEL || 'deepseek-v4-flash',
   thinking: process.env.THINKING || env.THINKING || 'enabled',
   baseUrl: process.env.DEEPSEEK_BASE_URL || env.DEEPSEEK_BASE_URL || 'https://api.deepseek.com',
+  loginMaxAttempts: Number(process.env.LOGIN_MAX_ATTEMPTS || env.LOGIN_MAX_ATTEMPTS || 5),
+  loginLockMinutes: Number(process.env.LOGIN_LOCK_MINUTES || env.LOGIN_LOCK_MINUTES || 5),
   sessionSecret: ensure('SESSION_SECRET', () => crypto.randomBytes(32).toString('hex')),
   vapidPublicKey: vapid.publicKey,
   vapidPrivateKey: vapid.privateKey,