Implement rate limiting against brute force

Implement rate limiting on the login endpoint specifically to defend against automated brute-force attacks. Use [Redis / in-memory store] to track the count of failed login attempts per IP address and per username separately. After [N] consecutive failures lock the account for a configurable duration and return a clear error. After [M] failures require a CAPTCHA challenge before allowing further attempts. Log every lockout event and suspicious attempt with the IP, timestamp, and username for security monitoring.