[Hardening] F-15: Failure to Block Abusers by IPs.

### The required feature described as a wish

**Description:** CloudStack does not monitor or restrict API authentication attempts based on the source IP address. A single client can submit unlimited failed authentication attempts across any number of accounts without being identified or blocked.

**Affected Components:** Management API

**Impact:** An attacker operating from a single source address can systematically target multiple user accounts with repeated failed login attempts, deliberately triggering lockouts across all accounts, preventing legitimate users and administrators from accessing the platform.

**Steps to Reproduce:**
- Using a custom script or a brute-forcing tool (e.g., `hydra`), send a high volume of failed authentication attempts targeting multiple user accounts.
- Observe that the requests are processed without any source IP tracking, flagging, or blocking.
- Confirm that targeted accounts transition to a disabled state while the source IP remains unrestricted.

**Recommended Remediation:** Log all authentication attempts and source IPs to `/var/log/cloudstack/management/auth.log` so tools like Fail2Ban can automatically detect brute-force attacks and block malicious traffic (via `iptables` or `nftables`). For even faster protection, a system administrator can craft a custom script using `inotify` to trigger real-time blocks via network edge appliances, stopping attackers' traffic before they ever reach CloudStack.

Comece pelo fluxo de autenticação da CloudStack Management API e determine onde as tentativas com falha e os IPs de origem podem ser observados. Use a saída proposta em /var/log/cloudstack/management/auth.log como o ponto de integração esperado, depois reproduza os ataques com um script personalizado ou hydra e verifique se as tentativas são registradas em um formato que o Fail2Ban possa usar para bloqueá-las.

Escrita pelo modelo de indexação a partir do texto da issue.