feat(web): harden login gate — throttle, scoped TLS, token-derived seal key

Remediates the two web-console residuals from the 2026-07-05 posture audit:

- Brute-force throttle (loginThrottle.ts): per-IP exponential backoff
  after 5 free attempts, plus a global floor for spread-out floods, keyed
  on the socket peer IP (not spoofable X-Forwarded-For) with a size-capped
  map. The constant-time compare already stopped the timing leak; this
  bounds guess *volume* against a by-design LAN-exposed console.
- Session seal key now derives from the high-entropy mgmt token instead of
  the low-entropy login password, so a captured cookie is no longer an
  offline password oracle. Falls back to the password only when no token
  is configured (dev/local). Rotating the token now invalidates sessions.
- Replace the process-wide NODE_TLS_REJECT_UNAUTHORIZED=0 with per-request
  Bun TLS scoped to the loopback proxy hop; a non-loopback mgmt URL now
  verifies normally. Dropped the env var from the systemd unit, Steam Deck
  installer, Windows run scripts, env examples, and web README.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

web/server/routes/_auth/login.post.ts

@@ -1,13 +1,26 @@
 // POST /_auth/login {password} — verify the shared password (constant-time), then seal an
 // authenticated session cookie. Public (allowlisted in the gate) so an unauthenticated user
-// can actually log in.
-import { createError, defineEventHandler, readBody, useSession } from "h3";
+// can actually log in. Brute force is bounded by an in-memory per-IP throttle (loginThrottle):
+// the constant-time compare stops a timing leak, the throttle stops guessing at volume.
+import {
+	createError,
+	defineEventHandler,
+	getRequestIP,
+	readBody,
+	setResponseHeader,
+	useSession,
+} from "h3";
 import {
 	type SessionData,
 	sessionConfig,
 	timingSafeEqual,
 	uiPassword,
 } from "../../util/auth";
+import {
+	recordLoginFailure,
+	recordLoginSuccess,
+	throttleRetryAfterMs,
+} from "../../util/loginThrottle";
 
 export default defineEventHandler(async (event) => {
 	const expected = uiPassword();
@@ -17,11 +30,28 @@ export default defineEventHandler(async (event) => {
 			statusMessage: "auth not configured",
 		});
 	}
+	// The socket peer address — deliberately NOT trusting X-Forwarded-For (spoofable unless we sit
+	// behind a known proxy, which the packaged console does not). Falls back to a single shared bucket
+	// if the address is somehow unavailable, so the throttle still applies.
+	const ip = getRequestIP(event) ?? "unknown";
+
+	// Throttle BEFORE touching the password so a locked-out client can't keep the guess loop spinning.
+	const wait = throttleRetryAfterMs(ip);
+	if (wait > 0) {
+		setResponseHeader(event, "Retry-After", Math.ceil(wait / 1000));
+		throw createError({
+			statusCode: 429,
+			statusMessage: "too many attempts — try again shortly",
+		});
+	}
+
 	const body = await readBody<{ password?: string }>(event);
 	const password = String(body?.password ?? "");
 	if (!timingSafeEqual(password, expected)) {
+		recordLoginFailure(ip);
 		throw createError({ statusCode: 401, statusMessage: "invalid password" });
 	}
+	recordLoginSuccess(ip);
 	const session = await useSession<SessionData>(event, sessionConfig());
 	await session.update({ authenticated: true });
 	return { ok: true };