security: rate limiting on auth endpoints (F-01/F-02)

[Abrechen2]

Summary

Follow-up to #92. Fixes the two HIGH-severity findings from the 2026-03-16 internal Kali pentest.

• F-01 (HIGH) — API key brute-force: per-IP sliding-window failure counter in `auth.py`. After 20 failed attempts within 60 s the IP receives `429 Too Many Requests` with `Retry-After: 60`. Uses `threading.Lock` + `defaultdict` — no external dependency, works correctly in single-worker Gunicorn.
• F-02 (HIGH) — Login brute-force: `@limiter.limit("10/minute; 30/hour")` on `POST /api/v1/auth/login` via flask-limiter 4.1.1 (added to `requirements.txt`). Limiter instance lives in `extensions.py`, `init_app()` called in `create_app()`.
• F-05 (MEDIUM) — Webhook exemption footgun documented with an explicit `IMPORTANT` comment in `auth.py` warning future developers.
• F-09 (LOW) — rpcbind service + socket unit disabled on LXC CT101 (infra fix, already applied; port 111 confirmed closed via nmap).

Test plan

• `ruff check . && ruff format --check .` — clean
• `pytest tests/test_auth.py tests/test_security.py tests/test_routes_auth_ui.py` — 48/48 passed
• Manual: 21 wrong API key requests → 21st returns 429 with Retry-After header
• Manual: 11 login attempts in < 1 min → 11th returns 429
• `nmap -p 111 192.168.178.194` → port closed (already confirmed)