feat(auth): tighten login throttle and alert on brute force

- Drop /login throttle from 10/min to 5/min per IP.
- After every failed login, count user.login.failed audit entries for
  the same email in the last 10 minutes. If >=5, fire a one-shot
  (cache-deduped) BruteForceLoginAlert notification to every super
  admin via database + mail channels.
- Alert carries the email, originating IP, failure count and window
  so the admin can decide whether to force a reset.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

app/Http/Controllers/Auth/AuthenticatedSessionController.php

@@ -4,8 +4,12 @@ namespace App\Http\Controllers\Auth;
 
 use App\Http\Controllers\Controller;
 use App\Models\AuditLog;
+use App\Models\User;
+use App\Notifications\BruteForceLoginAlert;
+use App\Support\SafeNotifier;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Cache;
 
 class AuthenticatedSessionController extends Controller
 {
@@ -50,11 +54,57 @@ class AuthenticatedSessionController extends Controller
             'details'   => ['email' => $credentials['email']],
         ]);
 
+        $this->detectBruteForce($request, $credentials['email']);
+
         return back()->withErrors([
             'email' => 'The provided credentials do not match our records.',
         ]);
     }
 
+    /**
+     * Fire one alert to super admins when the same email has racked up
+     * BRUTE_FORCE_THRESHOLD failures in BRUTE_FORCE_WINDOW_MINUTES. A Cache
+     * key with the same TTL prevents the alert from re-firing on every
+     * subsequent failed attempt within the same burst.
+     */
+    private const BRUTE_FORCE_THRESHOLD = 5;
+    private const BRUTE_FORCE_WINDOW_MINUTES = 10;
+
+    private function detectBruteForce(Request $request, string $email): void
+    {
+        $window = self::BRUTE_FORCE_WINDOW_MINUTES;
+        $threshold = self::BRUTE_FORCE_THRESHOLD;
+
+        // SQLite stores JSON-cast `details` as text; a LIKE-based match is
+        // database-portable and avoids per-driver JSON operator syntax.
+        $pattern = '%"email":"' . addslashes($email) . '"%';
+
+        $recent = AuditLog::where('action', 'user.login.failed')
+            ->where('created_at', '>=', now()->subMinutes($window))
+            ->where('details', 'like', $pattern)
+            ->count();
+
+        if ($recent < $threshold) {
+            return;
+        }
+
+        $cacheKey = 'brute_force_alert:' . sha1($email);
+        if (Cache::has($cacheKey)) {
+            return;
+        }
+        Cache::put($cacheKey, 1, now()->addMinutes($window));
+
+        $ip = $request->header('CF-Connecting-IP')
+            ?? $request->header('X-Forwarded-For')
+            ?? $request->ip()
+            ?? 'unknown';
+
+        $notification = new BruteForceLoginAlert($email, (string) $ip, $recent, $window);
+        User::where('role', 'super_admin')->each(function (User $admin) use ($notification) {
+            SafeNotifier::send($admin, $notification);
+        });
+    }
+
     public function destroy(Request $request)
     {
         $user = Auth::user();