feat: add IP-based login brute-force protection (#531)

* feat: add IP-based login brute-force protection

- Per-IP rate limiting: 3 failed login attempts locks the IP for 1 hour
- Separate counters for password login and token auth
- Global safety net: 20 req/min, hard lock after 50 total failures
- Persistent lock state to ~/.hermes-web-ui/.login-lock.json (survives restarts)
- Manual unlock: edit or delete the lock file
- Frontend handles 429/503 responses with localized error messages
- i18n support for 8 languages

* feat: add locked IP management endpoint and UI

- GET /api/auth/locked-ips: list all currently locked IPs (protected)
- DELETE /api/auth/locked-ips/:ip: unlock a specific IP (protected)
- DELETE /api/auth/locked-ips: unlock all IPs (protected)
- AccountSettings: shows locked IPs with remaining time, unlock buttons
- i18n support for 8 languages
- Clean up stale .js artifacts, add .gitignore rule

* fix: cross-type IP lock and IPv6-compatible unlock route

- Password and token login now share IP lock state: if an IP is locked
  by either method, ALL auth methods are blocked for that IP
- Changed unlock endpoint from path param to query param (?ip=xxx) to
  support IPv6 addresses containing colons
- Merged unlockIp and unlockAll into a single handler

* chore: increase global login rate limit from 20 to 100 requests per minute

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: ekko <fqsy1416@gmail.com>
Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

packages/client/src/i18n/locales/zh.ts

@@ -14,6 +14,7 @@ export default {
     passwordPlaceholder: '密码',
     credentialsRequired: '请输入用户名和密码',
     invalidCredentials: '用户名或密码错误',
+    tooManyAttempts: '登录失败次数过多，请稍后重试',
     passwordMismatch: '两次密码不一致',
     passwordTooShort: '密码长度至少 6 个字符',
     setupSuccess: '密码登录配置成功',
@@ -53,6 +54,7 @@ export default {
     update: '更新',
     create: '创建',
     noData: '暂无数据',
+    expired: '已过期',
     fetch: '获取',
     add: '添加',
     enable: '启用',
@@ -647,6 +649,16 @@ export default {
       cors: 'CORS 来源',
       corsHint: '允许的跨域来源',
     },
+    lockedIps: {
+      title: '锁定 IP 管理',
+      count: '{count} 个 IP 被锁定',
+      empty: '暂无锁定 IP',
+      unlock: '解锁',
+      unlockAll: '全部解锁',
+      unlockAllConfirm: '确认解锁所有锁定的 IP？',
+      unlocked: 'IP 已解锁',
+      allUnlocked: '已解锁 {count} 个 IP',
+    },
   },
 
   // 平台频道设置