feat(auth): tighten login throttle and alert on brute force

- Drop /login throttle from 10/min to 5/min per IP.
- After every failed login, count user.login.failed audit entries for
  the same email in the last 10 minutes. If >=5, fire a one-shot
  (cache-deduped) BruteForceLoginAlert notification to every super
  admin via database + mail channels.
- Alert carries the email, originating IP, failure count and window
  so the admin can decide whether to force a reset.

Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>

routes/auth.php

@@ -15,7 +15,7 @@ Route::middleware('guest')->group(function () {
 
     Route::get('login', [AuthenticatedSessionController::class, 'create'])->name('login');
     Route::post('login', [AuthenticatedSessionController::class, 'store'])
-        ->middleware('throttle:10,1')         // max 10 login attempts per minute per IP
+        ->middleware('throttle:5,1')          // max 5 login attempts per minute per IP
         ->name('login.store');
 });