Login protection sends duplicate block alerts and inconsistently records blocked failures

Description:

When Block_Multiple_Failed_Logins is enabled, two related problems can happen in the failed-login protection flow:

1. Duplicate notifications: once threshold is exceeded, alert notifications can be sent repeatedly for the same still-blocked user/IP on subsequent attempts.
2. Inconsistent failed-attempt persistence: error-login-blocked-for-user is ignored from failed-attempt storage, but error-login-blocked-for-ip is not, causing asymmetric telemetry.

Steps to reproduce:

1. Enable these settings:
   • Block_Multiple_Failed_Logins_Enabled = true
   • Block_Multiple_Failed_Logins_By_User = true
   • Block_Multiple_Failed_Logins_By_Ip = true
   • Block_Multiple_Failed_Logins_Notify_Failed = true
   • Block_Multiple_Failed_Logins_Notify_Failed_Channel = <valid-channel>
2. Set low thresholds (example: 3 attempts, unblock in 5 minutes).
3. Trigger failed logins for a target user/IP until the threshold is exceeded.
4. Keep trying login again during the block window.
5. Observe notifications and server_events entries.

Expected behavior:

• Notification should be sent once per block window (or deduplicated for the same active block state), not repeatedly for each blocked retry.
• Blocked retries should be handled consistently for storage/telemetry (user-blocked and IP-blocked should follow the same rule).

Actual behavior:

• Repeated blocked retries can continue generating notifications.
• error-login-blocked-for-user is ignored for failed-attempt storage, but error-login-blocked-for-ip is not.

Server Setup Information:

• Version of Rocket.Chat Server: N/A (Codespaces/Gitpod dev environment)
• License Type: N/A
• Number of Users: N/A
• Operating System: N/A
• Deployment Method: Codespaces/Gitpod
• Number of Running Instances: N/A
• DB Replicaset Oplog: N/A
• NodeJS Version: N/A
• MongoDB Version: N/A

Client Setup Information

• Desktop App or Browser Version: N/A
• Operating System: N/A

Additional context

Related auth files:

• apps/meteor/app/authentication/server/hooks/login.ts
• apps/meteor/app/authentication/server/lib/restrictLoginAttempts.ts
• apps/meteor/app/authentication/server/startup/index.js

Likely impact: noisy admin alerting + inconsistent login-attempt telemetry for risk reporting.

Relevant logs:

No external logs attached yet (local code-path analysis and reproducible behavior from current flow).

Start by tracing the failed-login flow through apps/meteor/app/authentication/server/hooks/login.ts and apps/meteor/app/authentication/server/lib/restrictLoginAttempts.ts, then inspect apps/meteor/app/authentication/server/startup/index.js. Verify how active user and IP blocks trigger notifications and failed-attempt storage; done means one notification per block window and consistent telemetry for both blocked error types.