Rate-limit VPN MFA proof failures per device (durable, not session-scoped)

MFA_FAILED_ATTEMPT_CAP = 5 lives on vpn_client_mfa_session.failed_attempts and is reset every time start_client_mfa_login supersedes the session - which needs only a location id and the device's WireGuard pubkey, no proof. An attacker can loop start → wrong codes → start indefinitely, so the cap bounds nothing except the TOTP code's own 30s validity window. Add a durable
per-(location, device) failure counter (or cooldown) that survives session deletion so repeated guesses are actually bounded. Follow-up hardening to #3043.