feat(auth): tighten login throttle and alert on brute force

- Drop /login throttle from 10/min to 5/min per IP.
- After every failed login, count user.login.failed audit entries for
  the same email in the last 10 minutes. If >=5, fire a one-shot
  (cache-deduped) BruteForceLoginAlert notification to every super
  admin via database + mail channels.
- Alert carries the email, originating IP, failure count and window
  so the admin can decide whether to force a reset.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

app/Notifications/BruteForceLoginAlert.php

@@ -0,0 +1,51 @@
+<?php
+
+namespace App\Notifications;
+
+use Illuminate\Bus\Queueable;
+use Illuminate\Notifications\Messages\MailMessage;
+use Illuminate\Notifications\Notification;
+
+/**
+ * Fires to every super admin when the same email or IP has produced several
+ * failed login attempts in a short window. Lets ops decide whether to lock
+ * the account, change the password, or just raise the global throttle.
+ */
+class BruteForceLoginAlert extends Notification
+{
+    use Queueable;
+
+    public function __construct(
+        public readonly string $email,
+        public readonly string $ip,
+        public readonly int $failures,
+        public readonly int $windowMinutes,
+    ) {}
+
+    public function via(object $notifiable): array
+    {
+        return ['database', 'mail'];
+    }
+
+    public function toArray(object $notifiable): array
+    {
+        return [
+            'kind'           => 'brute_force_login_alert',
+            'email'          => $this->email,
+            'ip'             => $this->ip,
+            'failures'       => $this->failures,
+            'window_minutes' => $this->windowMinutes,
+        ];
+    }
+
+    public function toMail(object $notifiable): MailMessage
+    {
+        return (new MailMessage)
+            ->subject('TAKEONE — suspicious login attempts')
+            ->greeting('Possible brute-force login attempt')
+            ->line("The address {$this->email} has had {$this->failures} failed login attempts in the last {$this->windowMinutes} minutes.")
+            ->line("Most recent attempt came from {$this->ip}.")
+            ->line('Review the audit log and consider forcing a password reset if this account looks real.')
+            ->action('Open Admin', url('/admin/audit-logs'));
+    }
+}