Rate limiting / brute-force protection on login attempts

Goal

Repeated failed login attempts against a single account or from a single client are throttled, so the login form isn't trivially brute-forceable.

Acceptance criteria

• After some threshold of failed login attempts (for a given username and/or source IP) within a time window, further attempts are rejected with a clear message rather than continuing to check the password — the exact threshold/window is a decision for whoever picks this up.
• Legitimate users are not locked out indefinitely by a burst of their own typos (the throttle window expires or is otherwise recoverable without manual intervention).

Out of scope

• Nothing identified yet.

Constraints

• No new dependency may be added without asking first, per AGENT.md — this includes any third-party throttling/rate-limit package; evaluate whether Django's own tooling (e.g. cache-based counters) is sufficient before proposing one.
• Split out of #3 (registration/login/logout): the plan's MVP scope for #3 deliberately did not include brute-force protection, since this is an internal small-team tool with no public signup funnel, but it shouldn't be silently dropped forever — hence this follow-up.

Read AGENT.md first, then inspect the existing login form and Django's cache-based tooling before choosing a counter strategy. Decide and document the threshold and time window, ensure throttling expires without manual intervention, and verify that blocked attempts receive a clear message without continuing password checks.